title: Java 8 How to make sure our code checks the full certificate chain?
body: <p>I have Spring Boot 1.5 app which is setting up a connection with some Web Services. In all the cases, these are TLS 1.2 connections. I run my app passing this JVM params:</p>
  
  <pre><code>-Djavax.net.ssl.keyStore=${KEYSTORE} \
  -Djavax.net.ssl.keyStorePassword=${KEYSTORE_PW} -&gt; password
  </code></pre>
  
  <p>The javax.net.ssl.keyStore is just a jks file with a single certificate in it.</p>
  
  <p>I need to answer this question: when setting up the TLS connection, how can I know if am I checking the full certificate chain? Or just the root certificate? Is it just depends on the CA I have in each of my certificates contained in my trust store?</p>
  
  <p>I use RestTemplate to make the connections:</p>
  
  <pre><code>ResponseEntity&lt;T&gt; response = restTemplate.exchange(uri, HttpMethod.PUT, requestEntity, T.class);
  </code></pre>
  
  <p>My RestTemplate instance has nothing fancy, this is how I build it:</p>
  
  <p>RestTemplate restTemplate = new RestTemplate();</p>
  
  <p>Thanks all.</p>
  
  <p>UPDATE Feb 14 2019</p>
  
  <p>I wanted to clarify something. I am 100% sure my code uses TLS 1.2. If I remove my certs from my key store, then all the calls start to fail complaining with SSL Exceptions. </p>
  
  <p>The certificate chain from the Service I'm calling consists on a leaf certificate and an intermediate certificate. They said they will update only the leaf certificate, and they said this:</p>
  
  <p><em>"If client systems trust VendorX-issued certificates with
  the complete chain, then the new Leaf Certificate will need to be updated."</em></p>
  
  <p>The part that confuses me is "the complete chain". What does that mean? Does it mean that you can either validate a part of the chain or the full chain?</p>