Restore missing certificates in the JDK keystore after a JDK patch in AEM

Last update: October 28, 2026

Adobe Experience Manager (AEM) may fail to establish secure connections after a JDK patch replaces the default keystore and removes previously installed certificates. To resolve the issue, import the required certificate into the JDK cacerts keystore for each affected Author and Publish instance and perform a rolling restart.

Description description

Environment

Adobe Experience Manager (AEM), all versions

Issue/Symptoms

AEM Author and Publish instances fail to establish HTTPS connections.
Errors related to missing certificates occur when retrieving tokens or connecting to external services.
Affected instances can’t complete secure connections because required certificates are missing.

Root cause

A JDK patch replaces the default keystore, removing previously installed certificates required for secure communications.

Resolution resolution

Follow the steps below to resolve the issue:

Obtain the required certificate file that needs to be installed in the JDK keystore.

Identify the JDK keystore (cacerts) for each AEM Author and Publish instance. The default path is usually:

code language-none
`${JAVA_HOME}/lib/security/cacerts`

Back up the existing cacerts file before making any changes.

Import the certificate into the keystore using the following command:

code language-none
`keytool -import -alias <certificate-alias> -file <certificate-file> -keystore <path-to-cacerts>`

When prompted, enter the keystore password. The default is changeit unless customized.

Repeat the import process for all Production Author and Publish instances.
After importing the certificate, perform a rolling restart of all affected AEM instances to ensure that the new certificate is loaded.

recommendation-more-help

experience-cloud-kcs-help-kbarticles