Unattended / silent install w/ custom system trust store
Posted: 21 Jul 2026, 13:35
As many corporations, our customer has its own root Certificate Authority to issue certificates for intranet-only use. Of course, the corresponding root certificate is missing from the user and system trust stores of OpenWebStart. With Microsoft Windows hardware under control of our customer the corresponding root certificate has been added to the Windows certificate stores by the central IT department, however.
Therefore, I want to roll out OpenWebStart with either a custom cacert system trust store (idea 1) or in such a way that OpenWebStart accesses the Windows certificate store instead of its own trust stores (idea 2). Both does not seem to work yet, however.
Idea 1: Even though not documented w/ OpenWebStart, IcedTea-Web, which to my understanding OpenWebStart is based upon, allows to specify "deployment.system.security.cacert" pointing to an alternative system trust store. I added our customer's root certificate to the "cacerts" file extracted from an OpenWebStart installation (which I then removed to avoid conflicts), tried to add the line "deployment.system.security.cacerts=C\:\\Program Files\\OpenWebStartCertificate\\cacerts" to "response.varfile" and then silently installed OpenWebStart using "OpenWebStart_windows-x64_1_13_0.exe -q -varfile response.varfile" and looked up the system trust store using OpenWebStart's Settings GUI. This shows not "C\:\\Program Files\\OpenWebStartCertificate\\cacerts," but "C\:\\Program Files\\OpenWebStart\\jre\\lib\\security\\cacerts" as if OpenWebStart ignored "deployment.system.security.cacert;" consequently, our customer's root certificate does not show up there.
Idea 2: Java and Sun's / Oracle's WebStart can be started using "-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT." I could not find any information on whether OpenWebStart can also be called using this command line option.
I am also open to other ways to fulfill the primary goal: Adding another root certificate to the system trust stores of potentially dozens or hundreds of OpenWebStart new (or existing) installations.
Ah, by the way: Is there a possibility to make the OpenWebStart installer add the value of "sys.installationDir" to the respective "PATH" environment variable? Calling "OpenWebStart_windows-x64_1_13_0.exe -q -varfile response.varfile" does not do so in my opinion.
Therefore, I want to roll out OpenWebStart with either a custom cacert system trust store (idea 1) or in such a way that OpenWebStart accesses the Windows certificate store instead of its own trust stores (idea 2). Both does not seem to work yet, however.
Idea 1: Even though not documented w/ OpenWebStart, IcedTea-Web, which to my understanding OpenWebStart is based upon, allows to specify "deployment.system.security.cacert" pointing to an alternative system trust store. I added our customer's root certificate to the "cacerts" file extracted from an OpenWebStart installation (which I then removed to avoid conflicts), tried to add the line "deployment.system.security.cacerts=C\:\\Program Files\\OpenWebStartCertificate\\cacerts" to "response.varfile" and then silently installed OpenWebStart using "OpenWebStart_windows-x64_1_13_0.exe -q -varfile response.varfile" and looked up the system trust store using OpenWebStart's Settings GUI. This shows not "C\:\\Program Files\\OpenWebStartCertificate\\cacerts," but "C\:\\Program Files\\OpenWebStart\\jre\\lib\\security\\cacerts" as if OpenWebStart ignored "deployment.system.security.cacert;" consequently, our customer's root certificate does not show up there.
Idea 2: Java and Sun's / Oracle's WebStart can be started using "-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT." I could not find any information on whether OpenWebStart can also be called using this command line option.
I am also open to other ways to fulfill the primary goal: Adding another root certificate to the system trust stores of potentially dozens or hundreds of OpenWebStart new (or existing) installations.
Ah, by the way: Is there a possibility to make the OpenWebStart installer add the value of "sys.installationDir" to the respective "PATH" environment variable? Calling "OpenWebStart_windows-x64_1_13_0.exe -q -varfile response.varfile" does not do so in my opinion.