From OpenEdge 13.1 onward, OpenEdge TLS client components use the OS trust store, by default. If your deployment requires the OpenEdge native trust store instead—for example, because you manage CA certificates separately from the OS or have internal CA certificates not added to the OS store—you can switch back to the native trust store using a configuration switch.

When you enable the native trust store, OpenEdge reads CA certificates from $DLC/certs on UNIX/Linux and %DLC%\certs on Windows, by default. If your CA certificates are in a different directory, use the -certstorepath parameter to specify that location so that OpenEdge reads from that path instead of the default $DLC/certs.

The OS trust store and the native trust store are mutually exclusive—OpenEdge does not combine them or fall back from one to the other.

To switch a component to the native trust store, set the corresponding parameter to 1 in the $DLC/properties/TLSPolicy.cnf policy file. For more information about the policy file and its parameters, see Trust store policy file.