If necessary, you can configure the trust strategy to accept new database certificates at run time, and permanently store them in the preferred truststore.

The following table describes the truststore properties that you configure in the truststore section of the

cfg/ddm.security

file:

Parameter Name	Description	Required	Default Value
storeType	Type of truststore, for example JKS, JCEKS, or PKCS12.	Yes
storeFile	Path to the truststore file.	No
storePassword	Password for the truststore.	No
provider	Name of the specific security provider that works with the truststore.	No
encrypted	If set to "true," Dynamic Data Masking encrypts unencrypted passwords at run-time.	No	false
preferred	If set to "true," Dynamic Data Masking loads the preferred truststore first, before any other truststores. Dynamic Data masking can add new certificates to the preferred truststore at run time. If you do not set a preferred truststore, Dynamic Data Masking might use new accepted certificates for the duration of current session. For more information, see the topic "Trust Strategies." You can set one preferred truststore in the cfg/ddm.security file.	No	false

At run time, Dynamic Data Masking loads truststores and checks trusted certificates in the following order:

The preferred truststore, specified in the
cfg/ddm.security
file.
Truststores specified using the Java Virtual Machine system property command-line options, for example in the file
jvm.params
.
javax.net.ssl.trustStore
javax.net.ssl.trustStoreType
javax.net.ssl.trustStorePassword
javax.net.ssl.trustStoreProvider
A truststore of the Java Virtual Machine, if any.
Other truststores specified in the
cfg/ddm.security
file.

If you do not configure the Dynamic Data Masking administrative tools with truststores in the file

cfg/client.security

, the administrative tools accept any signed certificate that the Dynamic Data Masking Server provides.

Note that JDBC database drivers can use only one truststore with all public certificates which is set in the Java Virtual Machine system properties.

The Dynamic Data Masking Server automatically generates a composite temporary truststore file named

cfg/ddm.temp.jceks

.

This truststore is used to discover metadata in SSL-enabled databases and perform impersonation in Dynamic Data Masking. It is also used to test the connection to SSL-enabled databases through the

Add Database

form.

The composite truststore file contains entries added from all configured truststores, including the truststore defined in the Java Virtual Machine system properties. That composite truststore is set, and can override an existing truststore, in the Java Virtual Machine system properties. The Dynamic Data Masking Server always creates a new temporary composite truststore at startup for the current Dynamic Data Masking Server session. The Dynamic Data Masking Server also deletes the old temporary composite truststore, if it remains after a previous session.

The temporary composite truststore is used to support the functionality of JDBC drivers in the Java Virtual Machine. If you have not configured the Dynamic Data Masking Server to work with SSL-enabled databases, the Dynamic Data Masking Sever does not generate the composite truststore.