Subject: [pgjdbc/pgjdbc] issue #3869: Support for javax.net.ssl.trustStoreType and javax.net.ssl.trustStore

From: "mkarg (@mkarg)" <[email-masked]>
Date: Thu, 20 Nov 2025 13:14:19 +0000

# Enhancement Request

## Aim

Please add support for `javax.net.ssl.trustStoreType` and `javax.net.ssl.trustStore`.

## Description

The PostgreSQL JDBC Driver shall respect and support the global Java properties `javax.net.ssl.trustStoreType` and `javax.net.ssl.trustStore`: When those properties are given non-null, the JDBC driver shall load the certificates for TLS server verification from the trust store defined by those properties.

## Justification

* This is an integral feature of OpenJDK.
* Other JDBC drivers (e. g. Microsoft SQL Server) do respect and support it.
* On Windows clients it is typical to hold the server certificates in a Windows-integrated (non-file) store ("Local Machine Certificate Store" aka `certlm`). OpenJDK has built-in support for certificate lookups from that store. It just needs to get enabled using `java -Djavax.net.ssl.trustStoreType=Windows-ROOT -Djavax.net.ssl.trustStore=NUL` to make use of it.
* On Windows, it is (due to that) *untypical and uncalled complicated* to explicitly move a certificate from that OS-integrated store to a standalone file on disk.

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Thu, 20 Nov 2025 13:29:55 +0000

did you mean JDBC `Other ODBC drivers (e. g. Microsoft SQL Server) do respect and support it.` ?

---

From: "mkarg (@mkarg)" <[email-masked]>
Date: Fri, 21 Nov 2025 11:32:53 +0000

Sorry this was a typo. Yes, certainly I meant to write `Other JDBC drivers`.