Add instructions for self signed certicate

[velo]

Create doc with the workaround discuessed on #543 (comment)

[coollog]

Hi @velo , thanks for writing up this extensive documentation! We'll take a look at this soon :)

[Hi-Fi]

Maybe just adding the default password (changeit) to document, too?

I think it should also work with -D argument, but I didn't tested that.

[velo]

just adding the default password

What password? Not sure what you mean.

[Hi-Fi]

Default password for Java keystore, that is "changeit". I think it should be in document.

[velo]

Mine was not password protected, which step was that?

[Hi-Fi]

At the end of step one it can mentioned, that

By default Oracle Java's keystore is password protected. If that's the case (and password hasn't been changed), the password Keystrore explorer asks is "changeit".

[kaikramer]

To help with the confusion about the password protection of cacerts: Since version 5.2 KeyStore Explorer automatically tries to open cacerts with the default password ("changeit"). It only prompts for a password if this fails.

[briandealwis]

Thanks @velo for this contribution! I made a couple of suggestions.

[briandealwis]

do not -> does not
self signed certificate -> self-signed certificates

[briandealwis]

the self signed -> a self-signed
jvm -> JVM

[briandealwis]

How about:

Jib uses the JRE's list of approved CA Certificates to validate SSL certificates. The following instructions describe how to add a registry's self-signed certificate to the JRE's approved CAs.

[chanseokoh]

How about also adding

"The certificate will be trusted at the JRE level, affecting all Java applications running on it. You will also need to re-import the certificate when you use a different JRE or upgrade it."

[briandealwis]

My 2¢: it would be easier to have the user use Open an existing KeyStore and navigate to the cacerts file (with default password changeit).

Then there are two approaches:

• if the user has the self-signed certificate, they can import it.
• if they don't have the self-signed certificate, they can import it from the running service with the Examine SSL option. It allows importing the certificate directly into the keystone.

[velo]

I guess this import process has multiple possible ways to be done.... I describe the one I used

[velo]

@chanseokoh @briandealwis changes applied

[chanseokoh]

Thanks! This looks good and will work.