When the client makes a connection request, the server presents its public certificate for the client to accept or deny. The client checks the issuer of the certificate against a list of trusted Certificate Authorities (CAs) that resides in the Java Virtual Machine's (JVM) default truststore.

Certificate trust verification

The driver is JDBC-based and obtains trusted CA certificates from the JVM's default truststore, typically located at JRE_HOME/lib/security/cacerts. If the server's certificate matches a trusted CA in the JVM truststore, an encrypted connection is established between the client and server. If the certificate does not match, the connection fails and the driver generates an error.

Adding certificates to the JVM truststore

To add a custom CA certificate to the JVM truststore, use the Java keytool utility.
keytool -importcert -alias alias_name -file certificate_file 
-keystore JRE_HOME/lib/security/cacerts -storepass cacerts_password
Where:
  • alias_name is a unique name to identify the certificate in the truststore.
  • certificate_file is the path to the CA certificate file (DER or PEM format).
  • The default password for the JVM cacerts truststore is changeit.
Note: The version of TLS/SSL that is used and which cryptographic algorithm is used depends on which JVM you are using. Refer to your JVM documentation for more information about its TLS/SSL support.