For a policy information provider (PIP), you can use the Java Runtime Environment (JRE)'s default trust store or you can provide a custom Java KeyStore (JKS) or PKCS12 trust store.
The policy engine supports the use of PIPs to dynamically retrieve data from external services at runtime. By default, the policy engine determines whether it should accept a PIP's server certificate using the Java Runtime Environment (JRE)'s default trust store, which contains public root certificates for common certificate authorities. However, if your PIP uses a server certificate issued by some other certificate authority, for example, a private certificate authority operated by your organization, then you can provide a custom Java KeyStore (JKS) or PKCS12 trust store.
When using embedded PDP mode, the trust store containing the client certificate is represented in the PingAuthorize Server configuration as a Trust Manager Provider, which is then assigned to the Policy Decision Service.
The following example creates a Trust
Manager Provider named
MyCATruststore and makes it available to the
dsconfig create-trust-manager-provider \ --provider-name MyCATruststore \ --type file-based \ --set enabled:true \ --set trust-store-file:<full path to a trust store> \ --set trust-store-type:JKS dsconfig set-policy-decision-service-prop \ --set service-trust-store:MyCATruststore
you define the policy information provider in the Trust Framework, you can refer to
the trust store that you configured using the name