Truststore

A truststore is a repository of trusted X.509 certificates used to validate the authenticity of a peer in TLS/SSL communications. It contains trusted root certificates and, in some implementations, intermediate CA certificates. A truststore does not hold private keys; keys and certificates used to present identity belong in a keystore.

During a TLS handshake, the peer presents a certificate chain. The client verifies the chain against the truststore’s trusted certificates. If the chain leads to a trusted root, the certificate is considered valid and the connection proceeds; otherwise the connection is rejected or a warning is shown. Revocation checks via CRL or OCSP may be used to determine if a certificate has been revoked.

Truststores exist in multiple forms across platforms. A keystore stores private keys and their associated certificates, while a truststore stores only certificates that are trusted to identify others. Formats include Java KeyStore (JKS) or PKCS#12, and operating system stores such as Windows certificate store, macOS Keychain, and various Linux CA bundles. Applications may provide their own truststore or rely on the system’s global store.

Management involves adding or removing certificates to reflect trusted authorities, typically through certificate management tools or OS updates. Revocation status may be checked in real time or cached, depending on configuration. A broad or misconfigured truststore can enable untrustworthy authorities; best practices emphasize limiting trusted roots, timely updates, and, where appropriate, additional techniques like certificate pinning for high-risk scenarios.