Enhancement: Add letsencrypt CA to the keystore

[rlfnb]

Brief Summary

Letsencrypt is widely used for securing TLS connections. Unfortunately, its not part of the keystore being distributed in the payara distribution (at least for community edition).

Expected Outcome

each, via letsencrypt secured TLS service can be consumed from inside payara without having to deal with CAs.

Current Outcome

no via letsencrypt secured TLS service can be consumed from inside payara without having to deal with adding the CA to the keystore.

Alternatives

At least describe how to make letsencrypt secured services work in payara:

Context

doing this once is not a big thing, but taking care of correct keystores in zip file, in docker images and so on is getting quite fast annoying?

`
RUN /usr/lib/jvm/zulu17/bin/keytool -import -alias letsencrypt -file /letsencrypt.pem -keystore /opt/payara/appserver/glassfish/domains/domain1/config/cacerts.p12 -storepass changeit -noprompt

`

[felixif]

Hello @rlfnb,

I have checked the cacerts.p12 file bundled with Payara Server 6.2023.9, and I can see that we already bundle the letsencrypt to the CA store, under the name letsencryptisrgx1, so you shouldn't need to manually add it.

[github-actions]

Greetings,
It's been more than 5 days since we requested more information or an update from you on the details of this issue. Could you provide an update soon, please?
We're afraid that if we do not receive an update, we'll have to close this issue due to inactivity.

[github-actions]

Greetings,
It's been more than 5 days since this issue was identified as abandoned.
We have closed this issue due to inactivity, please feel free to re-open it if you have more information to share.

[rlfnb]

I have checked the cacerts.p12 file bundled with Payara Server 6.2023.9, and I can see that we already bundle the letsencrypt to the CA store, under the name letsencryptisrgx1, so you shouldn't need to manually add it.

Seems like thw wrong one? I'm forced to add the following cert to the keystore to access a webservice secured by letsencrypt. Otherwise it will fail. Maybe you have a look?

https://letsencrypt.org/de/certificates/ ISRG Root X1 (RSA 4096, O = Internet Security Research Group, CN = ISRG Root X1)
for completeness