I am rather confused by the purpose of the trustore file in a tomcat server.
I.e use of the truststoreFile
parameter when setting up a TLS enabled connector.
According to the tomcat docs:
truststoreFile
The trust store file to use to validate client certificates. The default is the value of the javax.net.ssl.trustStore system property. If neither this attribute nor the default system property is set, no trust store will be configured.
To me this is telling me that for an inbound connection to my tomcat server, this is where I would store certificates that a client would present. (e.g. a users browser)
Would I really put in 3rd party CA certificates here or other 3rd party server certificates, if my tomcat server wants to make an outbound connection to a TLS enabled server (e.g. an LDAPS server)?
As per my understanding the place to do this is the cacerts file.
To elaborate further, the purpose of truststoreFile
seems to be explicity different from the java parameter javax.net.ssl.trustStore
The latter appears to be for trusting 3rd party CA certs, in much the same way as a browsers CA list.
The default file being jssecerts
or cacerts
Have I got this completely wrong?