#1552: add certificates to truststore by MarvMa · Pull Request #1789 · devonfw/IDEasy

MarvMa · 2026-03-30T11:15:29Z

This PR fixes #1552

Implemented changes:

Added a new TruststoreCommandlet which is accessible via ide fix-tls-vpn-problem <url> command.
Added a TruststoreUtil
- Create or update a custom Truststore
- Copy existing certificates from cacerts to custom truststore
- Add a Certificate to the custom Truststore

The functionality has been tested on Windows 11 and WSL Debian.

Checklist for this PR

Make sure everything is checked before merging this PR. For further info please also see
our DoD.

When running mvn clean test locally all tests pass and build is successful
PR title is of the form #«issue-id»: «brief summary» (e.g. #921: fixed setup.bat). If no issue ID exists, title only.
PR top-level comment summarizes what has been done and contains link to addressed issue(s)
PR and issue(s) have suitable labels
Issue is set to In Progress and assigned to you or there is no issue (might happen for very small PRs)
You followed all coding conventions
You have added the issue implemented by your PR in CHANGELOG.adoc unless issue is labeled
with internal

Checklist for tool commandlets

Have you added a new «tool» as commandlet? There are the following additional checks:

The tool can be installed automatically (during setup via settings) or via the commandlet call
The tool is isolated in its IDEasy project, see Sandbox Principle
The new tool is added to the table of tools in LICENSE.asciidoc
The new commandlet is a command-wrapper for «tool»
Proper help texts for all supported languages are added here
The new commandlet installs potential dependencies automatically
The variables «TOOL»_VERSION and «TOOL»_EDITION are honored by your commandlet
The new commandlet is tested on all platforms it is available for or tested on all platforms that are in scope of the linked issue

…evonfw#1750-gourlupdater

…etManger

…evonfw#1751-create-go-commandlet

…and doc for go

…evonfw#1687-fix-JLine-warning

…ruststore

…changable password for the custom truststore

…evonfw#1552-add-certificates-to-truststore

coveralls · 2026-03-30T11:27:27Z

Pull Request Test Coverage Report for Build 23899438687

Details

0 of 0 changed or added relevant lines in 0 files are covered.
19 unchanged lines in 2 files lost coverage.
Overall coverage decreased (-0.2%) to 70.468%

Files with Coverage Reduction	New Missed Lines	%
com/devonfw/tools/ide/commandlet/CommandletManagerImpl.java	8	90.16%
com/devonfw/tools/ide/network/NetworkStatusImpl.java	11	67.68%

Totals
Change from base Build 23894416328:	-0.2%
Covered Lines:	11068
Relevant Lines:	15066

💛 - Coveralls

hohwille

@MarvMa thanks for your PR. Excellent work! You really solved this complex problem nicely 🥇
It seems that some information was lost in the hand-over that I gave in earlier briefings and meetings to @lubska but I left review comments for that.

cli/src/main/java/com/devonfw/tools/ide/commandlet/TruststoreCommandlet.java

hohwille · 2026-03-30T12:32:17Z

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

+      return false;
+    }
+    String normalized = text.toLowerCase(Locale.ROOT);
+    return normalized.contains(ERROR_TEXT_PKIX) || normalized.contains(ERROR_TEXT_CERT_PATH) || normalized.contains(ERROR_TEXT_SSL_HANDSHAKE);


A TLS/SSL handshake exception is something completely different and should not be handled in the same way.
In such case we do not have a self-signed certificate and our workaround will not help in any way.
I am also not fully convinced that unable to find valid certification path is always indicating our problem we are trying to fix but at least this is very slightly related.

I removed the TLS handshake and unable to find valid certification path from the check. But i added "unable to get local issuer certificate" because this should be related to our problem and that message occurs when trying to install plugins for vscode:
Installing extensions... Installing extension 'esbenp.prettier-vscode'... Error while installing extension esbenp.prettier-vscode: unable to get local issuer certificate Failed Installing Extensions: esbenp.prettier-vscode

But the VSCode issue cannot be fixed by properly configuring the truststore for IDEasy.
VSCode is a separate tool run as an isolated process so it cannot know about our IDEasy truststore.
For me this still does not make sense.

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

hohwille · 2026-03-30T12:41:04Z

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

+
+  public static final char[] DEFAULT_CACERTS_PASSWORD = "changeit".toCharArray();
+
+  public static final char[] CUSTOM_TRUSTSTORE_PASSWORD = "changeit".toCharArray();


you already have TruststoreCommandlet.DEFAULT_TRUSTSTORE_PASSWORD.
Therefore, I would declare all these constants in one of the two places together and reference the String password to build the char[] constant.

Great, thanks for the rework.
However, you still have the password "changeit" as a constant in TruststoreUtil and in TruststoreCommandletTest.
If I would change only one of the two constants it would break.
So why two constants then if they represent the same thing?

cli/src/main/java/com/devonfw/tools/ide/util/TruststoreUtil.java

cli/src/main/java/com/devonfw/tools/ide/commandlet/TruststoreCommandlet.java

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

cli/src/test/java/com/devonfw/tools/ide/commandlet/StatusCommandletTest.java

hohwille

@MarvMa thanks for the update. Very nice improvements. 👍
We are on the finishing line but before we can merge there are some few points to address.

hohwille · 2026-04-02T07:06:47Z

cli/src/main/java/com/devonfw/tools/ide/commandlet/TruststoreCommandlet.java

+    String endpointInput = this.url.getValueAsString();
+    boolean defaultUrlUsed = false;
+
+    if (this.url.getValueAsString() == null || this.url.getValueAsString().isBlank()) {


Suggested change

if (this.url.getValueAsString() == null || this.url.getValueAsString().isBlank()) {

if (endpointInput == null || endpointInput.isBlank()) {

hohwille · 2026-04-02T07:14:01Z

cli/src/main/java/com/devonfw/tools/ide/commandlet/TruststoreCommandlet.java

+    LOG.info(
+        "This commandlet helps to fix TLS issues for users behind VPNs by capturing untrusted certificates from target endpoints and adding them to a custom truststore. It also configures IDE_OPTIONS to use the custom truststore by default. The commandlet is idempotent and will not make changes if the endpoint is already reachable or if the certificate is already trusted.");


Why not just adding this to cmd.fix-vpn-tls-problem.detail?
Currently the I18N support in IDEasy is still questionable since all exception and log messages are hardcoded to English, but since we started this feature, it would be consistent to keep it also for this help text.

hohwille · 2026-04-02T07:16:00Z

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

+      return false;
+    }
+    String normalized = text.toLowerCase(Locale.ROOT);
+    return normalized.contains(ERROR_TEXT_PKIX) || normalized.contains(ERROR_TEXT_CERT_PATH) || normalized.contains(ERROR_TEXT_SSL_HANDSHAKE);


But the VSCode issue cannot be fixed by properly configuring the truststore for IDEasy.
VSCode is a separate tool run as an isolated process so it cannot know about our IDEasy truststore.
For me this still does not make sense.

hohwille · 2026-04-02T07:18:18Z

cli/src/main/java/com/devonfw/tools/ide/truststore/TruststoreUtilImpl.java

+
+  public static final char[] DEFAULT_CACERTS_PASSWORD = "changeit".toCharArray();
+
+  public static final char[] CUSTOM_TRUSTSTORE_PASSWORD = "changeit".toCharArray();


Great, thanks for the rework.
However, you still have the password "changeit" as a constant in TruststoreUtil and in TruststoreCommandletTest.
If I would change only one of the two constants it would break.
So why two constants then if they represent the same thing?

cli/src/main/java/com/devonfw/tools/ide/util/TruststoreUtil.java

hohwille · 2026-04-02T07:29:54Z

cli/src/main/java/com/devonfw/tools/ide/commandlet/TruststoreCommandlet.java

+    super(context);
+    addKeyword(getName());
+    this.url = add(new StringProperty("", false, "url"));
+    this.cfg = add(new EnumProperty("--cfg", false, null, EnvironmentVariablesFiles.class));


Now you added this option but do not use it.
This will confuse end-users if you provide a documented option that has no effect.
Either remove it again and we merge and can later add it, or if you keep it then make the truststore location and EnvironmentVariables retrieval dependent on the configured value.

i removed this feature for now to finish the issue.

…ststore

cli/src/main/java/com/devonfw/tools/ide/util/TruststoreUtil.java

…evonfw#1552-add-certificates-to-truststore

…ttps://github.com/MarvMa/IDEasy into feature/devonfw#1552-add-certificates-to-truststore

MarvMa and others added 21 commits March 13, 2026 16:30

devonfw#1750: added Updater for golang support

5b8f1d5

Merge branch 'main' of https://github.com/devonfw/IDEasy into feature/d…

a13c169

…evonfw#1750-gourlupdater

devonfw#1751: create Go commandlet

4f72ebe

devonfw#1751: remove wrongly committed files

16b6a0e

devonfw#1751: added Go tag, fixed naming and added go to the commandl…

e2da970

…etManger

devonfw#1751: added tool installation for go

2e39d2f

Merge branch 'main' of https://github.com/devonfw/IDEasy into feature/d…

4945197

…evonfw#1751-create-go-commandlet

devonfw#1751: implemented go installation

0fe2b3d

devonfw#1751: updated implementation of go installation, added tests …

4a4f561

…and doc for go

devonfw#1751: added go-lang support for cli to changelog

e20a599

devonfw#1687: added argument to suppress native warning

10f9880

merge

92b1726

Merge branch 'main' into feature/devonfw#1687-fix-JLine-warning

dd0067a

Merge branch 'main' of https://github.com/devonfw/IDEasy into feature/d…

0905a1f

…evonfw#1687-fix-JLine-warning

devonfw#1687: updated changelog

189ed57

devonfw#1552: integrated a truststore commandlet to create a custom t…

5779788

…ruststore

devonfw#1552: integrated a truststore commandlet to create a custom t…

a4d5fdc

…ruststore

devonfw#1552: added tests, description for the commandlet and remove …

3736c9c

…changable password for the custom truststore

Merge branch 'main' of https://github.com/devonfw/IDEasy into feature/d…

e63fc70

…evonfw#1552-add-certificates-to-truststore

devonfw#1552: added tests for truststore cmdlet

61b29a8

devonfw#1552: update changelog

22b773a

github-project-automation bot moved this to 🆕 New in IDEasy board Mar 30, 2026

github-project-automation bot added this to IDEasy board Mar 30, 2026

MarvMa added enhancement New feature or request download download of tools, plugins, code from git, any HTTP traffic over the network labels Mar 30, 2026

devonfw#1552: log information if certificate related exception occurs

a937aac

MarvMa marked this pull request as ready for review March 30, 2026 11:27

MarvMa moved this from 🆕 New to Team Review in IDEasy board Mar 30, 2026

hohwille approved these changes Mar 30, 2026

View reviewed changes

github-project-automation bot moved this from Team Review to 👀 In review in IDEasy board Mar 30, 2026

MarvMa added 3 commits March 31, 2026 12:46

devonfw#1552: applied requested PR changes

72a5eb1

devonfw#1552: updated test

ea6dc23

devonfw#1552: update test

2dbe39d

MarvMa requested a review from ducminh02 March 31, 2026 13:18

MarvMa assigned MarvMa and ducminh02 Apr 1, 2026

hohwille approved these changes Apr 2, 2026

View reviewed changes

Merge branch 'main' into feature/devonfw#1552-add-certificates-to-tru…

ecdb045

…ststore

hohwille reviewed Apr 2, 2026

View reviewed changes

cli/src/main/java/com/devonfw/tools/ide/util/TruststoreUtil.java Show resolved Hide resolved

MarvMa added 3 commits April 2, 2026 12:52

Merge branch 'main' of https://github.com/devonfw/IDEasy into feature/d…

acece02

…evonfw#1552-add-certificates-to-truststore

Merge branch 'feature/devonfw#1552-add-certificates-to-truststore' of h…

fe95ff8

…ttps://github.com/MarvMa/IDEasy into feature/devonfw#1552-add-certificates-to-truststore

devonfw#1552: requested changes from pr

f8e194e

MarvMa moved this from 👀 In review to Team Review in IDEasy board Apr 2, 2026


		public static final char[] DEFAULT_CACERTS_PASSWORD = "changeit".toCharArray();

		public static final char[] CUSTOM_TRUSTSTORE_PASSWORD = "changeit".toCharArray();

	if (this.url.getValueAsString() == null \|\| this.url.getValueAsString().isBlank()) {
	if (endpointInput == null \|\| endpointInput.isBlank()) {

		LOG.info(
		"This commandlet helps to fix TLS issues for users behind VPNs by capturing untrusted certificates from target endpoints and adding them to a custom truststore. It also configures IDE_OPTIONS to use the custom truststore by default. The commandlet is idempotent and will not make changes if the endpoint is already reachable or if the certificate is already trusted.");

Conversation

MarvMa commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This PR fixes #1552

Implemented changes:

The functionality has been tested on Windows 11 and WSL Debian.

Checklist for this PR

Checklist for tool commandlets

Uh oh!

coveralls commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 23899438687

Details

💛 - Coveralls

Uh oh!

hohwille left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hohwille left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MarvMa commented Mar 30, 2026 •

edited

Loading

coveralls commented Mar 30, 2026 •

edited

Loading