@dalias @bagder this is why the entire notion of system-wide trust stores is so ludicrous. It comes from the mindset of web browser developers only, who want their client to be able to talk to any server without hassles. But for any other client-server application, you only want a specific set of clients talking to a specific set of servers, and therefore should have app-specific trust config. Esp if using cert-based client authent, you only want to trust one specific issuing CA.