title: Loading a custom key store in Google App Engine Java application
body: <p>I want to open a <strong>HTTPS</strong> connection in a Google App Engine app using the <a href="https://developers.google.com/appengine/docs/java/urlfetch/overview" rel="noreferrer">URLFetch</a> service. To be able <strong>to verify the SSL certificate of the server my app is talking to, I am using my own keystore file</strong>. I want to read this file in a <a href="https://developers.google.com/appengine/docs/java/config/appconfig#Warmup_Requests" rel="noreferrer">warmup request</a> when my app is loaded i.e. before any HTTPS requests are performed. The keystore file is part of my WAR file.</p>
  
  <pre><code>TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());  
  KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
  keystore.load(ClassLoader.getSystemResourceAsStream("myKeystoreFile"), "password".toCharArray());  
  trustManagerFactory.init(keystore);  
  
  TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();  
  SSLContext sslContext = SSLContext.getInstance("SSL");  
  sslContext.init(null, trustManagers, null);  
  
  HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
  </code></pre>
  
  <p>I cannot use this approach, however, because while HttpURLConnection is on the GAE's JRE whitelist, HttpsUrlConnection is not.</p>
  
  <p>Is there another way to use a custom keystore in GAE? I did not find any information on this in the GAE docs. <strong>It looks like while Google's URLFetch service supports HTTPS, the keystore cannot be customized.</strong> Is this correct?</p>
  
  <p>If this isn't possible, is the approach still valid in general? Or <strong>is there a different approach that does still allow me to verify the SSL certificate?</strong></p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>In 2009, App Engine developer Nick Johnson from Google said on <a href="https://groups.google.com/d/topic/google-appengine-python/C9RSDGeIraE/discussion" rel="noreferrer">https://groups.google.com/d/topic/google-appengine-python/C9RSDGeIraE/discussion</a>:</p>
  
  <blockquote>
    <p>The urlfetch API doesn't allow you to specify your own client 
    certificates, so unfortunately what you want to achieve is not 
    currently possible.</p>
  </blockquote>
  
  <p><strong>Is this still correct?</strong> If every HTTP(s) request in App Engine relies on URLFetch this would mean that custom certificates just cannot be used at all in GAE.</p>