title: Why does java have both the cacerts and jssecacerts files?
body: <p>I'm seriously confused on the differences between <code>cacerts</code> and <code>jssecacerts</code> files.</p>
  
  <p>I know that by default java looks for the <code>jssecacerts</code> file and then the <code>cacerts</code> file.</p>
  
  <p>But what is the point of the <code>jssecacerts</code> file?</p>
  
  <p>My understanding is that if a new truststore needs to be used then a copy of <code>cacerts</code> should be made and all new trusted CAs should be added to that copy. The copy of <code>cacerts</code> (with the new CAs) should then be referenced by the <code>-Djavax.net.ssl.trustStore</code> system property.  That way other java applications that run on that machine won't accidently trust non-default CAs.</p>