Java 客户端不从 Windows 信任存储中选择根/中间证书

Question

I have a Jetty server running with SSL certificate which has root->intermediate->host certificate chain.

I have a Java client on Windows which connects to this server. I am using below system properties to set trust store but it does not work unless I import "host" certificate in Windows "Trusted Root Certificate Authorities" store. I have intermediary and root certificates in "Intermediate Certificate Authorities" store of Windows, but Java does not pick them and throws SSL error. However, Chrome works perfectly without issueing any warning.

System.setProperty("javax.net.ssl.trustStore", "NUL");  
System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT");

As per my understanding, even if root or intermediary certificate is there on client machine, Java should be able to pick it.
Is it required to put intermediates and root under "Trusted Root authorities" store? Would putting under "Intermediate Certificate Authorities" not work? From which store category, Java picks the certificates?

Please help.

Answer 1

This happens when the server only returns the leaf certificate and not the intermediate certificates. Does a TLS client needs to have intermediate CA in the trust store? explains it is actually a server issue and not a client issue. Following that advice it solved my issue.