I need an advice regarding the best practice of storing organisational CA on Linux servers for Java.
Basically, JRE installation contains a list of trusted CAs in cacerts file, which is used by default by java applications running on the server.
In order to support the organisation CA we are currently adding the CAs into the cacerts manually.
This approach works, however, the issue is that when you update the JRE the cacerts gets overwritten and so you have to add the certificates again.
I'm looking for some better solution for the process.
So, is there a way to keep the organisational CAs in some different file and use some global Linux/Java setting that would instruct java applications searching for CA in this file if not found in the cacerts?