# Keystore/trustore file of certs loaded in supplemental folder **URL:** \ **Category:** Ignition\ **Created:** [June 1, 2023, 1:06pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433 "2023-06-01T13:06:21Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![derrickdvdsn](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@derrickdvdsn](https://forum.inductiveautomation.com/u/derrickdvdsn)\ **Post date:** [June 1, 2023, 1:06pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/1 "2023-06-01T13:06:21Z")
After placing certificates in "Ignition\data\certificates\supplemental" in which keystore/truststore are they loaded to? I don't see them in Ignition\lib\runtime\jre-win\lib\security\cacerts nor do I see them in metro-keystore Thanks in advance. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 1, 2023, 1:12pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/2 "2023-06-01T13:12:38Z")
> [@derrickdvdsn](#): > > Ignition\lib\runtime\jre-win\lib\security\cacerts This should be where they end up. Did you restart the Ignition Gateway after adding certs to that directory? ---
**Author:** ![derrickdvdsn](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@derrickdvdsn](https://forum.inductiveautomation.com/u/derrickdvdsn)\ **Post date:** [June 1, 2023, 3:42pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/3 "2023-06-01T15:42:10Z")
> [@Kevin.Herron](#): > > Did you restart the Ignition Gateway Yes, I did restart it. I have a .pfx file in the folder ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/8/08e3c73ca0558ef5f4d2e9ba8621e55462eeeadf.png) But I can't seem to find it in the cacerts ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/d/9d20c6f60b1f5e60331a8289f800263499fc10bc.png) The one highlighted in yellow is another cert that I inserted manually. so ideally I would have to have 2 certs. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 1, 2023, 3:43pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/4 "2023-06-01T15:43:23Z")
You need to drop a DER-encoded or PEM-encoded certificate file into that directory, not a PFX file. ---
**Author:** ![derrickdvdsn](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@derrickdvdsn](https://forum.inductiveautomation.com/u/derrickdvdsn)\ **Post date:** [June 5, 2023, 12:34pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/5 "2023-06-05T12:34:36Z")
Does this load into the "cacerts"? ```auto KeyStore keyStore = KeyStore.getInstance("PKCS12"); keyStore.load(new FileInputStream(certPath), certPass); ``` ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 5, 2023, 1:25pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/6 "2023-06-05T13:25:44Z")
[https://docs.oracle.com/javase/8/docs/api/java/security/KeyStore.html#getInstance-java.lang.String-](https://docs.oracle.com/javase/8/docs/api/java/security/KeyStore.html#getInstance-java.lang.String-) > A new KeyStore object encapsulating the KeyStoreSpi implementation from the first Provider that supports the specified type is returned. ---
**Author:** ![derrickdvdsn](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@derrickdvdsn](https://forum.inductiveautomation.com/u/derrickdvdsn)\ **Post date:** [June 5, 2023, 2:03pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/7 "2023-06-05T14:03:27Z")
@Kevin.Herron can you please help me understand why this piece of code works only when I put the "xyz.pfx" file in the Ignition\data\certificates\supplemental folder? ```auto String certPath = "C:\folder\xyz.pfx"; String pass = "test_password"; char certPass[] = pass.toCharArray(); try { KeyStore keyStore = KeyStore.getInstance("PKCS12"); keyStore.load(new FileInputStream(certPath), certPass); KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); keyManagerFactory.init(keyStore, certPass); SSLContext ctx = SSLContext.getInstance("TLSv1.3"); ctx.init(keyManagerFactory.getKeyManagers(), null, null); HttpClient client = HttpClient.newBuilder().sslContext(ctx).build(); ``` Without the "xyz.pfx" in the supplemental folder, the code compiles and executes but I get "java.net.ConnectException' error" ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 5, 2023, 2:07pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/8 "2023-06-05T14:07:38Z")
Sorry, I have no idea why that makes a difference. > [@derrickdvdsn](#): > > `String certPath = "C:\folder\xyz.pfx";` I'd only expect it to work if there was actually a PFX at this path containing the appropriate root for whatever server you're talking to. ---
**Author:** ![derrickdvdsn](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@derrickdvdsn](https://forum.inductiveautomation.com/u/derrickdvdsn)\ **Post date:** [June 5, 2023, 2:31pm UTC](https://forum.inductiveautomation.com/t/keystore-trustore-file-of-certs-loaded-in-supplemental-folder/74433/9 "2023-06-05T14:31:22Z")
There is a PFX file in that directory but even if I put it in another directory like ```auto String certPath = "D:\folder\xyz.pfx"; ``` it seems to work as long as the PFX file is in the supplemental folder.