I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL.

The server itself have a SSL certificate and it is signed by a Issuer Certificate from e.g "Company A" which is itself signed by a Root CA (let say Company B).

My question is about which certificate I have to put in my trust store (a Java JVM) and what is the best practices?

I know if I put the server certificate itself, when it expire I have to renew it but for example I see now they already changed it before the expiry date (like two month before). If I trust the Issuer certificate (Company A) or the Root CA (Company B), I am afraid to trust too much servers that I do not need for now.

2 Answers 2


The best practice is to trust the root CA, for very practical reasons.

Root CAs are a special beast and are expected to have very long lifetimes (20 years or more) because they require replacement in the client software, which is usually a manual process.

Intermediate and server certificates are expected to change frequently - in some cases (load balancing for example) they can change minute-by-minute. You should not expect to receive any notification from the server operator when the certificate changes.

If you put the root CA in your trust store, you're saying "I trust this CA - any and every certificate signed by this CA is ok with me". That's usually ok, since the point of the CA is to provide a trustworthy signature for unknown servers.

The only time you would want to use a server certificate is when you don't trust the CA - but that itself causes further problems, and perhaps TLS is not the right approach in this case.

  • If you want to trust any certificate issued by A or B you put these into the trust store.
  • If you want to accept only this specific certificate as trusted than you should only add this certificate. But you are right that you get problems when the certificates gets renewed.
  • If you just want to trust this specific certificate only but want to accept it also if it gets renewed then you might trust the CA A or B but additionally use public key pinning. This way you will only trust any certificates containing this public key. Since with renewing the previous public key is often reused for the new certificate you will still accept this renewed certificate too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .