Supplies the CA certificates trusted when validating a peer's certificate chain, for example during a TLS handshake or, inside wsSecurity, when verifying a signature. See tutorials/web-services-security/50-Sign-And-Validate-Body.yaml.

Example Configuration

wsSecurity:
   truststore:
     location: signer.p12
     password: secret
   validate:
     - signature:
         requiredReferences:
           - by: BODY

wsSecurity:
   truststore:
     location: signer.p12
     password: secret
   validate:
     - signature:
         requiredReferences:
           - by: BODY

Syntax

truststore:
  algorithm: <string>
  checkRevocation: <string>
  location: <string>
  password: <string>
  provider: <string>
  type: <string>

truststore:
  algorithm: <string>
  checkRevocation: <string>
  location: <string>
  password: <string>
  provider: <string>
  type: <string>

Attributes

Name	Required	Default	Description	Examples
algorithm	false	the JVM's default (usually `PKIX`)	Trust manager algorithm used to validate certificate chains.	-
checkRevocation	false	-	Comma-separated PKIX revocation checking options, from `java.security.cert.PKIXRevocationChecker.Option`: ONLY_END_ENTITY, PREFER_CRLS, NO_FALLBACK, SOFT_FAIL. Unset, no revocation checking (CRL/OCSP) is performed at all.	ONLY_END_ENTITY,SOFT_FAIL
location	false	-	File or resource holding the store: a PKCS#12/JKS keystore file, or, with `type="PEM"`, one or more X.509 certificates.	-
password	false	-	Password used to open the keystore/truststore file. Required for a PKCS#12/JKS store, except when `type="PEM"`, where it is ignored - a bare certificate has no password. On a `<keystore>`, leaving this unset falls back to `keyPassword` (default `changeit`), which is the common case when the same password protects both the file and the private key entry inside it.	-
provider	false	-	Provider to use when loading the keystore.	-
type	false	-	Keystore type (e.g., `PKCS12`, `JKS`), or `PEM` to load `location` as one or more bare X.509 certificates (`.cer`/`.crt`/`.pem`) instead of a keystore container. `PEM` only makes sense for a `truststore`, since a bare certificate carries no private key. `location` may hold more than one certificate - either PEM blocks or DER certificates concatenated back to back - and every one of them becomes a separate trust anchor; this is how to trust a CA chain (root plus intermediates) when the peer's messages only ever carry its leaf certificate.	-

Can be used in

components ssl wsSecurity