Skip to main content

Agent trustStore

Portal SaaS is served through AWS CloudFront, and its TLS certificates chain to the Amazon Trust Services root CAs. Any RASP Java Agent connecting to Portal SaaS must trust those roots.

What decides this is the trustStore the Agent actually uses, which is not necessarily the JDK's. Current JDKs ship the Amazon roots in their default cacerts file, so an Agent using cacerts normally connects without any extra configuration. But an application started with its own trustStore replaces that default entirely, and a trustStore assembled for another purpose - an internal CA, a database or LDAP certificate - often contains no public roots at all.

If the Agent cannot build a chain to these roots, you can download a ready-made trustStore containing them rather than assembling one yourself.

Download​

Download the Portal SaaS trustStore (.zip)

The archive contains the trustStore in both JKS and PKCS#12 format, the individual root certificates in PEM form, and a checksum file.

The trustStore password is changeit.

This password protects the integrity of the store, not its confidentiality. A trustStore holds only public certificates, so the password is intentionally the same well-known default that the JDK uses for its own cacerts file.

Do you need this?​

You do not need this trustStore if your Agent already connects to Portal SaaS successfully. It is already building a valid chain, and this bundle would change nothing.

It is useful when:

  • the Agent runs on an old JDK whose cacerts predates the Amazon Trust Services roots;
  • the application starts with a custom trustStore that does not contain the roots, or whose password is not available to the Agent;

A typical symptom of a missing root is the Agent failing to onboard with a PKIX path building failed or unable to find valid certification path to requested target error in its log.

Contents​

The trustStore contains the five Amazon Trust Services roots. Amazon recommends trusting all five, because Amazon Root CA 1 through 4 use different key types and AWS may issue an endpoint certificate from any of them.

AliasSubjectKeyExpires
amazonrootca1Amazon Root CA 1RSA 20482038-01-17
amazonrootca2Amazon Root CA 2RSA 40962040-05-26
amazonrootca3Amazon Root CA 3ECDSA P-2562040-05-26
amazonrootca4Amazon Root CA 4ECDSA P-3842040-05-26
starfieldservicesrootg2Starfield Services Root Certificate Authority - G2RSA 20482037-12-31

Starfield Services Root CA G2 is the legacy root that cross-signs the Amazon roots. It is included so that older clients can still build a chain.

The trustStore contains root certificates only. It deliberately does not pin the endpoint or intermediate certificates, which AWS rotates without notice - a trustStore containing those would break the next time they changed.

Configuring the Agent​

Extract the archive somewhere the Agent can read, then set the following in your waratek.properties file, using an absolute path:

com.waratek.trustStore=/opt/waratek/waratek-portal-saas-truststore.jks
com.waratek.trustStorePassword=changeit
Agent version

Custom trust store flags are honored for any Portal connection on RASP Java Agent v25.7.0 and later.

Verifying the download​

Every file in the archive is listed in SHA256SUMS.txt:

shasum -a 256 -c SHA256SUMS.txt

To list what the trustStore actually contains:

keytool -list -keystore waratek-portal-saas-truststore.jks -storepass changeit

When this file changes​

It is published here, rather than bundled with an Agent release, so that it can be updated independently of the Agent release cycle. Waratek SaaS might need to change its CDN or TLS configuration, or Amazon might retire one of the roots. In this case, we will do our best to communicate the change and provide a new trustStore bundle ahead of time.