Truststores

A truststore is a repository of certificates that an application or system uses to verify the authenticity of other parties in TLS or SSL communications. It typically contains trusted root certificates and may include intermediate CA certificates. The truststore does not hold private keys and is used solely for trust decisions.

When a client connects to a server, the server presents a certificate chain. The client validates the chain against the certificates in its truststore. If the chain leads to a trusted root present in the truststore, the connection is accepted; otherwise it is rejected.

Formats and platforms vary. Java environments commonly use Java KeyStore or PKCS#12 for truststores. Linux and Unix-like systems rely on PEM certificates in a system-wide trust store, such as in /etc/ssl/certs. Windows uses the Windows Certificate Store.

Management involves adding trusted certificates, removing those that are compromised or expired, and updating stores as root authorities change. It is important to maintain chain validity, support revocation checks (CRLs and OCSP), and prevent unauthorized modification of the truststore.

Distinctions: a truststore is separate from a keystore. A keystore stores an entity's private keys and its certificates for identity, while a truststore stores certificates used to verify others.