Q: why java can connect to mssql server which using self-sign certifcate, it works without importing certficate into jvm's truststore My java program connects to mssql server which using self-sign certifcate , I did not even import this self sign certficate into jvm's truststore and but it works without any error, my question is why?
My understanding is if it is self-sign cerificate withou rootCA, I should manully import this self-sign cerificate into jvm's trustore
If a certificate is signed by trusted rootCA which usually by default already installed at jvm's truststore, so I could skip manully import step.
PS: I enable -Djavax.net.debug=ssl,handshake here is the output snipet of ssl
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.743 CEST|SSLCipher.java:438|jdk.tls.keyLimits:  entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472
    javax.net.ssl|WARNING|11|agroal-11|2021-05-13 10:31:51.820 CEST|ServerNameExtension.java:261|Unable to indicate server name
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.821 CEST|SSLExtensions.java:260|Ignore, context unavailable extension: server_name
    javax.net.ssl|WARNING|11|agroal-11|2021-05-13 10:31:51.829 CEST|SignatureScheme.java:295|Signature algorithm, ed25519, is not supported by the underlying providers
    javax.net.ssl|WARNING|11|agroal-11|2021-05-13 10:31:51.829 CEST|SignatureScheme.java:295|Signature algorithm, ed448, is not supported by the underlying providers
    javax.net.ssl|INFO|11|agroal-11|2021-05-13 10:31:51.835 CEST|AlpnExtension.java:161|No available application protocols
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.836 CEST|SSLExtensions.java:260|Ignore, context unavailable extension: application_layer_protocol_negotiation
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.836 CEST|SSLExtensions.java:260|Ignore, context unavailable extension: cookie
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.851 CEST|SSLExtensions.java:260|Ignore, context unavailable extension: renegotiation_info
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.851 CEST|PreSharedKeyExtension.java:634|No session to resume.
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.852 CEST|SSLExtensions.java:260|Ignore, context unavailable extension: pre_shared_key
    javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.855 CEST|ClientHello.java:653|Produced ClientHello handshake message (
    "ClientHello": {
      "client version"      : "TLSv1.2",
      "random"              : "8F 89 C6 64 55 42 1D 68 11 27 C3 8A 2A B4 82 42 E7 7A E7 46 02 DB 85 51 A1 C1 91 41 5D 4B 41 0B",
      "session id"          : "B2 F7 8F 58 B1 08 17 02 35 08 96 67 05 6D 71 FA 12 D4 35 4E 87 E7 82 5A 69 F4 A3 72 DE 72 E5 E3",
      "cipher suites"       : "[TLS_AES_128_GCM_SHA256(0x1301), TLS_AES_256_GCM_SHA384(0x1302), TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS

)
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.907 CEST|ECDHClientKeyExchange.java:401|Produced ECDHE ClientKeyExchange handshake message (
"ECDH ClientKeyExchange": {
  "ecdh public": {
    0000: 04 DF F2 5A 5B 8C DF 4B   49 FD 83 98 8C 98 58 7D  ...Z[..KI.....X.
    0010: 4F E1 15 F7 8C 6A BD DE   06 86 8E 65 7D A5 08 4F  O....j.....e...O
    0020: 9E E1 94 FB B9 71 EF ED   90 E7 B8 69 45 3F 78 B7  .....q.....iE?x.
    0030: FD 21 89 CB F4 9C 31 ED   C3 C7 FA 73 14 71 92 95  .!....1....s.q..
    0040: 8A                                                 .
  },
}
)
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.930 CEST|ChangeCipherSpec.java:115|Produced ChangeCipherSpec message
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.930 CEST|Finished.java:398|Produced client Finished handshake message (
"Finished": {
  "verify data": {
    0000: 70 7C 5F C4 A0 99 63 4B   B5 63 E1 CD
  }'}
)
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.933 CEST|ChangeCipherSpec.java:149|Consuming ChangeCipherSpec message
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.935 CEST|Finished.java:535|Consuming server Finished handshake message (
"Finished": {
  "verify data": {
    0000: D2 A0 06 FA 35 21 2B E1   5B 15 CA 15
  }'}
)
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.937 CEST|SSLSocketImpl.java:479|duplex close of SSLSocket
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.938 CEST|SSLSocketImpl.java:1578|close the underlying socket
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.938 CEST|SSLSocketImpl.java:1597|close the SSL connection (initiative)
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.938 CEST|SSLSocketImpl.java:1625|wait for close_notify or alert
javax.net.ssl|DEBUG|11|agroal-11|2021-05-13 10:31:51.938 CEST|SSLSocketImpl.java:736|close inbound of SSLSocket
javax.net.ssl|ALL|11|agroal-11|2021-05-13 10:31:51.938 CEST|SSLSocketImpl.java:1633|discard plaintext while waiting for close (
contentType: 0/majorVersion: 0/minorVersion: 0/recordEpoch: -1/recordSN: 0xffffffffffffffff/fragment: null
)

