Fatal error when `JAVA_HOME` is set incorrectly

Environment

Operating system (including version): macOS 12.4 (21F79)
mkcert version (from mkcert -version): v1.4.4
Server (where the certificate is loaded): N/A
Client (e.g. browser, CLI tool, or script): N/A

What you did

Ran mkcert -install

What went wrong

Error for reference

$ mkcert -install
The local CA is now installed in the system trust store! ⚡️
ERROR: failed to execute "keytool -list": exit status 1

keytool error: java.lang.Exception: Keystore file does not exist:

I have my JAVA_HOME ($HOME/homebrew/opt/openjdk) set to a user based homebrew location but it seems that neither of the following files exists causing the util to fatally abort.

$JAVA_HOME/lib/security/cacerts

mkcert/truststore_java.go

Line 47 in 2a46726

if pathExists(filepath.Join(v, "lib", "security", "cacerts")) {
$JAVA_HOME/jre/lib/security/cacerts

mkcert/truststore_java.go

Line 51 in 2a46726

if pathExists(filepath.Join(v, "jre", "lib", "security", "cacerts")) {

This forces the util to execute an invalid command with a missing param passed to -keystore.

$HOME/homebrew/opt/openjdk/bin/keytool -list -keystore  -storepass changeit

tl;dr when using a java install via homebrew set your JAVA_HOME to somewhere that has the file mkcert is looking for 😅.

This is ultimately what worked for me 🥳.

JAVA_HOME=<homebrewDir>/Cellar/openjdk/19/libexec/openjdk.jdk/Contents/Home"

Hope this helps anyone else who runs into a similar issue.

I've opened a PR with a fix here #474

Would be nice if, on Mac OS, every JVM under /Library/Java/JavaVirtualMachines would be like "root infected", not only the JAVA_HOME one.

Thanks @Hacksore I was using jenv https://www.jenv.be/ and it's openjdk64-11.0.15 java version had a path
~/.jenv/versions/openjdk64-11.0.15/libexec/openjdk.jdk/Contents/Home before those sub paths were correct like your fantastic issue summary indicated. openjdk64-11.0.17 or 11.0.17 had the paths needed for this fix.

@joelpittet glad it helped you.

Still waiting for @FiloSottile to have a look at the open PR to at least warn for this.

Lost interest in this in favor of caddy. Maybe this will get traction at some point but at least there is a workaround now.