LDAPS flow ignores configured truststore and fails with CERTIFICATE_UNKNOWN error

We are trying to use LDAPS with TLS over port 636, this however results in failure.
javax.net.debug system property is set to "ssl:handshake:verbose:keymanager:trustmanager" for debugging.

DefaultTlsDirContextAuthenticationStrategy is configured using a custom SSLSocketFactory with a custom truststore.

The custom truststore is correctly picked up during configuration:
[javax.net](http://javax.net/).ssl|DEBUG|10|main|X509TrustManagerImpl.java:82|adding as trusted certificates (

But, is quickly over-written with default cacerts

javax.net.ssl|DEBUG|93|XNIO-1 task-1|TrustStoreManager.java:113|trustStore is: /Library/Java/JavaVirtualMachines/temurin-21.jdk/Contents/Home/lib/security/cacerts trustStore type is: pkcs12

And, this finally results in failure:
javax.net.ssl|DEBUG|D3|XNIO-1 task-1|2024-06-12 09:48:37.369 IST|CertificateMessage.java:1135|Consuming server Certificate handshake message ( "Certificate": { "certificate_request_context": "", "certificate_list":

javax.net.ssl|DEBUG|93|XNIO-1 task-1|CertificateMessage.java:1135|Consuming server Certificate handshake message ( "Certificate": { "certificate_request_context": "", "certificate_list": [ { "certificate" : { "version" : "v3",

javax.net.ssl|ERROR|93|XNIO-1 task-1|TransportContext.java:370|Fatal (CERTIFICATE_UNKNOWN): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (

The same code/configuration works with STARTTLS over port 389 and the only difference being that the custom truststore is not being over-written.
javax.net.ssl|DEBUG|10|main|2024-06-12 09:50:06.124 IST|X509TrustManagerImpl.java:82|adding as trusted certificates ( "certificate" : {

javax.net.ssl|DEBUG|D3|XNIO-1 task-1|CertificateMessage.java:1135|Consuming server Certificate handshake message ( "Certificate": { "certificate_request_context": "", "certificate_list": [

javax.net.ssl|DEBUG|D3|XNIO-1 task-1|X509TrustManagerImpl.java:246|Found trusted certificate ( "certificate" : {

Version information:
JDK: 21
spring-boot: 3.3.0
spring-ldap: 3.2.3

Also, native-pooling is disabled.

Start by tracing DefaultTlsDirContextAuthenticationStrategy and its custom SSLSocketFactory configuration, then compare the LDAPS flow on port 636 with STARTTLS on port 389. Done means the configured truststore remains effective during the LDAPS handshake and the CERTIFICATE_UNKNOWN failure is resolved.