TLSPolicy.cnf is a centralized configuration policy file that provides administrative control over how an OpenEdge installation manages its TLS trust store. It allows administrators to specify whether OpenEdge should use the OS trust store (0) or the OpenEdge native trust store (1) for certificate validation.

The trust store file is located at:

  • $DLC/properties/TLSPolicy.cnf on UNIX or Linux
  • %DLC%\properties\TLSPolicy.cnf on Windows

The defaultTruststore parameter

The defaultTruststore parameter controls which trust store a component uses. It accepts the following values:

Value Trust store used
0 OS trust store
1 OpenEdge native trust store

By default, all parameters in the TLS trust store policy file are set to 0, except the parameter governing TLS client authentication for PAS for OpenEdge. A value of 0 indicates that corresponding OpenEdge TLS client component will use the OS trust store for certificate validation. This means that, out of the box and without any modifications to the policy file, all OpenEdge TLS client components—except PAS for OpenEdge client authentication—are configured to use the OS trust store.

When a parameter is set to 1 for a given component, that component bypasses the OS trust store to use the native trust store implementation that was supported prior to OpenEdge 13.1. Depending on the component, this implementation might be the OpenEdge-specific certificate directory at $DLC/certs, the JDK trust store, or another native trust store that the component historically relied upon.

Policy file scope

The TLS trust store policy file organizes its parameters into two distinct scopes—install-level and instance-level—each targeting a different category of OpenEdge components.
  • Install-level properties apply to the components that operate independently of any specific PAS for OpenEdge instance. These components are available at the installation level and are not bound to a particular PAS for OpenEdge instance—for example, AVM-based components such as the ABL Client and the HTTP Client. Install-level properties are prefixed with Install in the policy file and control the default trust store behavior for these unbound components.
    Parameter Component
    Install.AVM.defaultTruststore AVM-based clients — ABL clients, HTTP clients, Web Client, and MSAgent client connections
    Install.JOC.defaultTruststore Java Open Clients
    Install.STSClientUtil.defaultTruststore STS client utility
    Install.STSKeyUtil.defaultTruststore STS key client utility
  • Instance-level properties apply to the components that are tied to a specific PAS for OpenEdge instance. These properties are prefixed with Instance in the policy file and allow administrators to configure trust store behavior on a per-instance basis, independent of the install-level defaults.
    Parameter Component
    Instance.PASOE.ClientAuthentication.defaultTruststore PAS for OpenEdge inbound TLS client authentication (defaults to 1)
    Instance.PASOE.STSClient.defaultTruststore PAS for OpenEdge connecting to OpenEdge Application Gateway
    Instance.PASOE.WebApp.defaultTruststore PAS for OpenEdge outbound connections to external services (LDAP, SAML, OESectool, and so on)
    Instance.MSAgent.defaultTruststore MS Agent connecting to other PAS for OpenEdge instances or external servers
    Instance.JGet.defaultTruststore JGet utility

Layered Policy Files: Precedence and Fallback Behavior

The TLS trust store policy framework follows a layered approach with two tiers of configuration, enabling both centralized control and per-instance customization:
  • The first layer is the central policy file, $DLC/properties/TLSPolicy.cnf, present at the installation level and applies across the entire OpenEdge installation. It serves as the baseline configuration for all OpenEdge TLS client components and defines the default trust store behavior for both install-level and instance-level parameters.
  • The second layer is the instance-level policy file. When a PAS for OpenEdge instance is created, the central policy file is copied to the <instance_name>/conf directory. This copy retains only the instance-level parameters, allowing administrators to tailor the trust store behavior for that specific instance without affecting other instances or the broader installation.

PAS for OpenEdge resolves its configuration by using the central policy file as the baseline. If an instance-level policy file exists in the conf directory of the instance, any parameters defined in it take precedence over their counterparts in the central policy file, but only for that instance. If the instance-level policy file is absent or unreadable, PAS for OpenEdge falls back gracefully to the central policy configuration.

If neither the central nor the instance-level policy file is present, all components revert to the OpenEdge-enforced default trust store behavior—all OpenEdge TLS client components except PAS for OpenEdge client authentication are configured to use the OS trust store.

The precedence order from highest to lowest is as follows:
  1. Instance-level policy file (<instance_name>/conf/TLSPolicy.cnf)—If present, its parameters override the central policy for that instance.
  2. Central policy file ($DLC/properties/TLSPolicy.cnf)—Applies installation-wide and serves as the fallback when no instance-level file is available.
  3. OpenEdge-enforced defaults—If no policy file is found at either level, the built-in default behavior takes effect, directing all components (except PAS for OpenEdge client authentication) to use the OS trust store.
Note: Java Open Client inherits only the resulting configuration value and not the policy semantics, governance responsibilities, or enforcement behavior associated with the referenced installation.