Following are frequent issues encountered along with their causes and resolutions, when adopting OS trust store:

  • TLS handshake fails immediately after upgrading to 13.1—The most common cause is a CA certificate that existed in $DLC/certs but was not present in the OS trust store before the upgrade. Add the missing CA certificate to the OS trust store, or set the component's defaultTruststore parameter to 1 in TLSPolicy.cnf to switch back to the native trust store. Restart the component after making changes.

  • Java Open Client fails on Linux—Verify that oelinuxtruststoreprovider-13.1.0.jar is present in $DLC/java/oe/. Also confirm that the system CA bundle exists and is readable at the expected distribution path (for example, /etc/ssl/certs/ca-certificates.crt on Debian or Ubuntu). If the CA bundle is missing or empty, the LinuxOSTruststore provider cannot assemble its in-memory keystore and the TLS connection will fail.

  • CA certificate changes are not picked up after modification—OpenSSL-based components (ABL clients, HTTP clients, Web Client, MS Agent) load certificates lazily at connection time, so a store change is picked up on the next TLS connection without a restart. Java-based components (PAS for OpenEdge, Java Open Clients) load the trust store at startup. After adding or removing a CA certificate in the OS trust store, restart PAS for OpenEdge or the Java Open Client process for the change to take effect.

  • TLSPolicy.cnf changes have no effect—Confirm there are no spaces around the = sign in the parameter value, because the file accepts only key=value format and not key = value. Verify that you edited the correct copy of the file: instance-level parameters in <instname>/conf/TLSPolicy.cnf take precedence over install-level parameters in $DLC/properties/TLSPolicy.cnf. Restart the component after saving.

  • Containerized PAS for OpenEdge—CA certificates not trusted—In Docker or Kubernetes environments, OpenEdge reads from the CA trust store inside the container image. CA certificates added to the host OS trust store are not visible inside the container. Add the required CA certificates to the container image at build time using the update-ca-trust or update-ca-certificates command of the distribution.