I've a SLSB that acts as a web service client. It consumes the remote web service over HTTPS. I've imported the certificate in a truststore. The location of the truststore and the password are set in javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword. This works fine when I run my application in JBoss 4.0.2. When I run the application in JBoss 4.0.3 I get an java.io.FileNotFoundException

I've looked in the source code for 4.0.3 and I can see that the org.jboss.axis.components.net.JSSE14SocketFactory looks for the keyStore file and if it doesn't find it in org.jboss.webservice.keyStore property or javax.net.ssl.keyStore property it looks for it at System.getProperty("user.home") + "/.keystore". This is the reason for the exception in my case, because this file doesn't exist on my system. I've always thought that keystore and truststore are confusing, and I've always thought that keystore was for the server side and truststore was for the client side. In my case, I'm the client side, and then I only should need the truststore, or? If I change the source for org.jboss.axis.components.net.JSSE14SocketFactory.getKeyStore to work the same way as getTrustStore works(return null in case it can't find it), my application runs fine in 4.0.3.

Is this a bug, or is it me that hasn't understood the keystore/truststore concept correctly?

Cheers

//Anders