title: Best way to package liberty app with default java truststore (cacerts)
body: <p>I'm packaging a liberty application which works with Db2. When we run locally, we configure certificates to secure the connection from app to db.</p>
  
  <p>Now I'm trying to package the same application for use with the Db2 on Cloud service, and I'm having trouble with the SSL configuration.</p>
  
  <p>I think I could create a truststore and add the digicert root CA to it and package that with the app, but instead I was leaning toward just using the JDK's built-in cacerts (because we also have restrictive firewall rules preventing outbound connections to other hosts).</p>
  
  <p>I found extremely relevant discussion at <a href="https://github.com/OpenLiberty/open-liberty/issues/4377" rel="nofollow noreferrer">https://github.com/OpenLiberty/open-liberty/issues/4377</a>, but I can't seem to find a nice way to specify the path to the JDK's cacert store in a portable way.</p>
  
  <p>I tried setting it as follows:
  <code>&lt;keyStore id="defaultKeyStore" location="${env.JAVA_HOME}/jre/lib/security/cacerts"/&gt;</code></p>
  
  <p>But for some reason it doesn't resolve the environment variable. Why?</p>
  
  <p>Additionally, this will only work when the JAVA_HOME is set to a JDK (like in development). In our containers, we don't have that and so we don't want the <code>jre</code> part in the path.</p>
  
  <p>Whats the simplest/easiest way to tell Liberty just to use the JDK's default truststore (in a portable way)?</p>