title: Update Java trust certificate store from PKI source anchors on Unix
body: <p>I manually added some new certificates to <code>/etc/pki/ca-trust/extracted/java/cacerts</code> and it makes Java trust these certificates as Java is configured to use this certificate location. However, from what I'm reading to do it properly and and make sure this change survives future cert system updates it should be done so:</p>
  
  <ul>
  <li>add to <code>/etc/pki/ca-trust/source/anchors</code></li>
  <li>run <code>update-trust-ca</code></li>
  </ul>
  
  <p>However, this doesn't work, i.e. certificates from source anchors are not transferred to Java <code>cacerts</code>.</p>
  
  <p>A proposed solution discussed here <a href="https://access.redhat.com/discussions/3018271" rel="nofollow noreferrer">https://access.redhat.com/discussions/3018271</a> is to first run "trust anchor /etc/pki/ca-trust/source/anchors/*.cer" but then I'm getting "p11-kit: couldn't create object: The field is read-only".
  How can this error be fixed? How to proceed with it?</p>
  
  <p>System:</p>
  
  <pre><code>cat /etc/redhat-release
  CentOS Linux release 7.7.1908 (Core)
  </code></pre>
  
  <p>Java:</p>
  
  <pre><code>java -version
  openjdk version "1.8.0_242"
  OpenJDK Runtime Environment (build 1.8.0_242-b08)
  OpenJDK 64-Bit Server VM (build 25.242-b08, mixed mode)
  </code></pre>