From OpenEdge 13.1 onwards, OpenEdge TLS client components use the OS trust store as the default source of trusted CA root certificates for validating TLS server connections. It also retains the flexibility to use native trust store, when required.

This behavior is controlled by the TLS trust store policy file, $DLC/properties/TLSPolicy.cnf that provides administrative control to configure which trust store—OS or OpenEdge native—is used for certificate validation. For more information about the policy file and its configurable parameters, see Trust store policy file.

Using the OS trust store eliminates the need to maintain a separate, OpenEdge-specific certificate store across installations. When a CA certificate is added, updated, or revoked at the OS level—using the standard tools and certificate management policies of the organization—OpenEdge automatically reflects that change. Administrators no longer need to manually update certificates in the $DLC/certs directory or run OpenEdge-specific certificate management utilities to keep trust stores in sync.

This approach also ensures a consistent trust posture across the host. Because OpenEdge trusts the same set of CA certificates as the OS and all other applications running on the same host, certificate validation behavior becomes predictable and uniform. If the OS and other applications on the host accept a TLS server's certificate, OpenEdge also accepts it and conversely, if a certificate is revoked or removed from the OS trust store, OpenEdge ceases to trust it without requiring any separate intervention.

This consistency offers practical benefits beyond operational convenience:
  • It simplifies troubleshooting by letting administrators verify trusted certificates in a single location rather than cross-referencing multiple stores.
  • It helps organizations meet security and compliance requirements that mandate all applications to use the OS-managed, centrally-governed certificate store rather than maintaining independent trust anchors.