title: Is there any way to handle Server SSL certificate upgrade?
body: <p>Here is a situation, </p>
  
  <ol>
  <li>Our application is consuming a REST service over HTTPS.</li>
  <li>To take care of SSL, We have exported the public certificate from the browser (By Accessing the URL, the Public Certificate gets installed). </li>
  <li>We imported that certificate in our local client side JKS store. </li>
  <li>What client (The party hosting the REST web services) is saying that they keep on upgrading certificates every year (as the certificate validity is one year).</li>
  <li>They have sent a certificate chain (Root cert and one intermediate authority and NO certificate), and asked us to import it in our keystore, so that whenever they upgrade, our client will always work. </li>
  <li>I suspected that it wont work. We could import the certificate chain in truststore but when we invoke REST, we get error as bellow, </li>
  </ol>
  
  <p>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: <strong>End user tried to act as a CA</strong>
  at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
  at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884)</p>
  
  <ol start="6">
  <li>I believe that everytime they upgrade the certificate, the same also needs to be imported in our keystore for it to work. </li>
  </ol>
  
  <p>Question is, is this the only way forward(Update your truststore everytime the server public cert is upgraded), or there is a way out ?</p>