We had been using java standard keystore (`$JAVA_HOME/jre/lib/security/cacerts`) as the trusted store for tomcat. And that tomcat server would communicate with some other server. A recent OS(AIX) upgrade apparently over-wrote the file at `$JAVA_HOME/jre/lib/security/cacerts` and that resulted in lost certificates and lot of issues with application hosted in tomcat.

Looking at this is it a bad practice to relay up on $JAVA\_HOME/jre/lib/security/cacerts ? 
What are the alternate (better|standard) ways to tackle this scenario?