Martin Paul Eve bio photo

Martin Paul Eve

Professor of Literature, Technology and Publishing at Birkbeck, University of London and Technical Lead of Knowledge Commons at MESH Research, Michigan State University

Email (BBK) Email (MSU) Email (Personal) Books Bluesky Github Stackoverflow KC Works Institutional Repo Hypothes.is ORCID ID  ORCID iD Wikipedia Pictures for Re-Use

davmail uses Java certificate store, not central ca-certificates

Cite as: Martin Paul Eve, "davmail uses Java certificate store, not central ca-certificates", https://eve.gd, , https://doi.org/10.59348/p45j7-fjr65.

A note to self (and others) for when this problem happens again. My university today updated the certificate for their OWA webmail service, signed by a certificate authority that I did not have in my trust chain.

This triggers the following error in DavMail: “java.security.cert.CertificateException: User rejected certificate”.

In order to fix it, you need to install the certs into the Java keystore, which is different to the central ca-certificates package on Debian.

So, use Firefox or similar to download the PEM files (authority + chain), then do the following in a bash script:

“for file in *.pem; do openssl x509 -outform der -in “$file” -out /tmp/certificate.der; keytool -import -alias “$file” -keystore ./java/cacerts -file /tmp/certificate.der -deststorepass changeit -noprompt; done;”