# Java truststore — APPLEBEE-ROOT26
#
# Two options. A dedicated truststore is preferable to editing the JDK's
# cacerts, because a JDK upgrade replaces cacerts and silently drops your
# root, whereas a separate file survives.

# ── Option 1: a dedicated truststore (recommended) ──
keytool -importcert -noprompt -alias applebee-root26-root \
    -file applebee-root26-roots.pem \
    -keystore internal-truststore.jks -storepass changeit

# Then point the JVM at it:
#   -Djavax.net.ssl.trustStore=/path/internal-truststore.jks
#   -Djavax.net.ssl.trustStorePassword=changeit

# ── Option 2: into the JDK's own cacerts ──
# Re-run this after every JDK upgrade.

# ECDSA (P-256)  (sha256 b1aa5115d3adbfb821e8ca6a7db14de180640eb4da3586066b13fe76aec1c762)
keytool -importcert -noprompt -alias applebee-root26-ecdsa \
    -file applebee-root26-ecdsa-root.pem \
    -cacerts -storepass changeit

# RSA (legacy compatibility)  (sha256 95fb9ab7db52c08b1084fc7756ed30c64dabe4cdc5dcb77847ccd6f7a8cf9d7b)
keytool -importcert -noprompt -alias applebee-root26-rsa \
    -file applebee-root26-rsa-root.pem \
    -cacerts -storepass changeit

# Verify what landed:
keytool -list -keystore internal-truststore.jks -storepass changeit | grep -i applebee-root26