---
title: SecretsTrustManager
description: Uses the Commons Secrets Service to manage trust material that verifies the credentials presented by a peer. Trust material is usually public key certificates. The configuration references the secrets store that holds the trust material.
component: pinggateway
version: 7.2
page_id: pinggateway:reference:SecretsTrustManager
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/SecretsTrustManager.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-02T16:30:54Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/SecretsTrustManager.html
section_ids:
  SecretsTrustManager-usage: Usage
  SecretsTrustManager-properties: Properties
  SecretsTrustManager-example: Example
  SecretsTrustManager-moreinfo: More information
---

# SecretsTrustManager

Uses the Commons Secrets Service to manage trust material that verifies the credentials presented by a peer. Trust material is usually public key certificates. The configuration references the secrets store that holds the trust material.

## Usage

```json
{
  "name": string,
  "type": "SecretsTrustManager",
  "config": {
    "verificationSecretId": configuration expression<secret-id>,
    "secretsProvider": SecretsProvider reference,
    "checkRevocation": configuration expression<boolean>
  }
}
```

## Properties

* `"verificationSecretId"`: *configuration expression<[secret-id](preface.html#definition-secretid)>, required*

  The secret ID to retrieve trusted certificates.

* `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), required*

  The SecretsProvider to query for secrets to resolve trusted certificates. For more information, see [SecretsProvider](secrets.html#SecretsProvider).

* `"checkRevocation"`: *configuration expression<[boolean](preface.html#definition-boolean)>, optional*

  Specifies whether to check for certificate revocation.

  Default: `true`

## Example

The following example trusts a list of certificates found in a given keystore:

```json
{
  "type": "SecretsTrustManager",
  "config": {
    "verificationSecretId": "trust.manager.secret.id",
    "secretsProvider": {
      "type": "KeyStoreSecretStore",
      "config": {
        "file": "path/to/certs/truststore.p12",
        "storePassword": "keystore.pass",
        "secretsProvider": "SecretsPasswords",
        "mappings": [{
          "secretId": "trust.manager.secret.id",
          "aliases": [ "alias-of-trusted-cert-1", "alias-of-trusted-cert-2" ]
        }]
      }
    }
  }
}
```

## More information

[Secrets](secrets.html)

[org.forgerock.openig.secrets.SecretsTrustManagerHeaplet](../_attachments/apidocs/org/forgerock/openig/secrets/SecretsTrustManagerHeaplet.html)