Merge custom CA with default trust store instead of replacing it

When a custom CA certificate is configured, the previous implementation
created an empty KeyStore and only added the custom cert, which dropped
all JVM default trust anchors. This meant connections to hosts using
publicly-trusted certificates would fail. Now the default trusted certs
are loaded into the KeyStore alongside the custom CA.

Author: mridang

src/main/java/com/zitadel/ApiClient.java

@@ -146,6 +146,16 @@ public X509Certificate[] getAcceptedIssuers() {
                 KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
                 ks.load(null, null);
                 ks.setCertificateEntry("custom-ca", caCert);
+                TrustManagerFactory defaultTmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+                defaultTmf.init((KeyStore) null);
+                int certIndex = 0;
+                for (javax.net.ssl.TrustManager tm : defaultTmf.getTrustManagers()) {
+                    if (tm instanceof javax.net.ssl.X509TrustManager) {
+                        for (java.security.cert.X509Certificate cert : ((javax.net.ssl.X509TrustManager) tm).getAcceptedIssuers()) {
+                            ks.setCertificateEntry("default-" + certIndex++, cert);
+                        }
+                    }
+                }
                 TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                 tmf.init(ks);
                 SSLContext sslContext = SSLContext.getInstance("TLS");

src/main/java/com/zitadel/auth/OpenId.java

@@ -82,6 +82,16 @@ public X509Certificate[] getAcceptedIssuers() {
                     KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
                     ks.load(null, null);
                     ks.setCertificateEntry("custom-ca", caCert);
+                    TrustManagerFactory defaultTmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+                    defaultTmf.init((KeyStore) null);
+                    int certIndex = 0;
+                    for (TrustManager tm : defaultTmf.getTrustManagers()) {
+                        if (tm instanceof X509TrustManager) {
+                            for (java.security.cert.X509Certificate cert : ((X509TrustManager) tm).getAcceptedIssuers()) {
+                                ks.setCertificateEntry("default-" + certIndex++, cert);
+                            }
+                        }
+                    }
                     TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                     tmf.init(ks);
                     SSLContext sslContext = SSLContext.getInstance("TLS");