I have a system which consume web-services from a public server on Internet (but the data are not public) I have to provide credentials in Basic Auth to get the data, that is why we use SSL.
The server itself have a SSL certificate and it is signed by a Issuer Certificate from e.g "Company A" which is itself signed by a Root CA (let say Company B).
My question is about which certificate I have to put in my trust store (a Java JVM) and what is the best practices?
I know if I put the server certificate itself, when it expire I have to renew it but for example I see now they already changed it before the expiry date (like two month before). If I trust the Issuer certificate (Company A) or the Root CA (Company B), I am afraid to trust too much servers that I do not need for now.