A Java keystore stores private key entries, certificates with public keys or just secret keys that we may use for various cryptographic purposes. It stores each by an alias for ease of lookup.
Generally speaking, keystores hold keys that Alfresco owns, or you as a customer owns, that we can use to prove the integrity of a message and the authenticity of the sender, say by signing payloads.
Usually, we’ll use a keystore when we are a server and want to use HTTPS, such as the Repository (i.e. alfresco.war). During an SSL handshake, the server looks up the private key from the keystore and presents its corresponding public key and certificate to the client.
Correspondingly, if the client also needs to authenticate itself (a situation called mutual authentication), such as with Solr, then the client also has a keystore and also presents its public key and certificate.
There’s no default keystore, so if we want to use an encrypted channel, we’ll have to set javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword. If our keystore format is different than the default, we could use javax.net.ssl.keyStoreType to customize it.
Of course, we can use these keys to service other needs as well. Private keys can sign or decrypt data, and public keys can verify or encrypt data (i.e. node property/metadata encryption). Secret keys can perform these functions as well. A keystore is a place that we can hold onto these keys.
We can also interact with the keystore programmatically.