How to Find Out What Keystore My Jvm Is Using

Where is the location of Keystore file in JAVA?

Why the keytool cannot list the Root CA without the -keystore & -storepass flags?

It can, starting with Java 9:

keytool -list -cacerts

Just press enter on password prompt.

where JAVA stores the private keys?

Java doesn't store them anywhere.

You store them in a keystore file, anywhere you want on the file system. Then you tell the "server" where it is.

Exactly how you do that depends on what the "server" is, e.g. for Tomcat you give the path to the keystore file in the server.xml file.

How to acess jvm default KeyStore?

There should be enough example code in the KeyStore Javadocs page to get you started:

https://docs.oracle.com/javase/9/docs/api/java/security/KeyStore.html

As for the 'default' keystore - I'm not sure such a thing exists, normally you either load it explicitly from a file, or you can configure it using the following system properties:

javax.net.ssl.keyStore - Keystore location
javax.net.ssl.keyStorePassword - Keystore password
javax.net.ssl.keyStoreType - Keystore type (JKS, P12 etc)

And similar for the trust store:

javax.net.ssl.trustStore
javax.net.ssl.trustStorePassword
javax.net.ssl.trustStoreType

SSL and cert keystore

System.setProperty("javax.net.ssl.trustStore", path_to_your_jks_file);

Which is the default location for keystore/truststore of Java applications?

In Java, according to the JSSE Reference Guide, there is no default for the keystore, the default for the truststore is "jssecacerts, if it exists. Otherwise, cacerts".

A few applications use ~/.keystore as a default keystore, but this is not without problems (mainly because you might not want all the application run by the user to use that trust store).

I'd suggest using application-specific values that you bundle with your application instead, it would tend to be more applicable in general.

Java Keystore in project

You're confusing two types of stores. cacerts is a truststore; you need a keystore. In short, roughly, the truststore is who you trust and the keystore is who you are.

Using an X.509 certificate is the correct way to manage a private key (such as with SSL). You can specify certificates through properties passed to Java when starting your application (be it a standalone application or a container like Tomcat) or programmatically. This SO answer provides a concise overview of the properties required to configure your keystore and truststore. You probably won't have to do anything with the truststore.