Question about `idp.authn.LDAP.trustCertificates` property

[Cantor, Scott]

> When using `idp.authn.LDAP.sslConfig` = certificateTrust, I have observed
> the value of the `idp.authn.LDAP.trustCertificates` property can point to a
> PEM formatted certificate for an LDAP service.  Can the file it points to
> contain anything else?  E.g. Multiple certificates or a CA root?  The
> documentation, "A resource to load trust anchors from, usually a local file in
> %{idp.home}/credentials" is not very explicit in this regard.

When it says trust anchors, it means exactly that, it should accept one or more certificates in a file, each of which is loaded into the standard Java PKIX path validator by the LDAP layer. Any certificate amongst the chain can be fed in as an anchor and it will terminate the path (that's standard PKIX).

-- Scott