4ALLPORTAL4ALLPORTAL
All ideas

Use platform trust store or allow custom trust store integration

Administrators want the Media Database to use the platform trust store (or support additional customer trust stores), so secure outbound HTTPS communication can be configured centrally without modifying the application's internal Java trust store. Problem / Pain In some enterprise environments, all communication to external services must pass through a corporate proxy. These proxies often perform TLS inspection and therefore replace the original certificate chain with certificates issued by the company's internal PKI. Currently, the Media Database relies on its own Java trust store. To establish trusted connections through the proxy, customer-specific certificates must be added manually to this trust store. While this can be achieved through technical workarounds such as extending the trust store via an InitContainer, it increases operational complexity and maintenance effort. Because the platform trust store, proxy infrastructure, and application are often managed by different teams, keeping multiple trust stores synchronized creates an ongoing risk of configuration drift and certificate-related outages. Impact / Benefit Allowing the Media Database to use the platform trust store, merge it with its internal trust store, or reference an additional customer-managed trust store would: Reduce administrative overhead. Eliminate the need to modify the application's internal trust store. Simplify certificate management in enterprise environments. Reduce the risk of outages caused by missing or expired certificates. Improve compatibility with common corporate proxy and PKI architectures. Provide a reusable solution that could benefit many customers facing similar security requirements. Example use case A customer operates the Media Database in an OpenShift environment where all outbound traffic is routed through a TLS-inspecting corporate proxy. The proxy uses certificates issued by the company's internal PKI. Instead of manually injecting these certificates into the Media Database's Java trust store, the application should automatically trust certificates available through the platform trust store or an additional customer-provided trust store.