When EAP application does auto-registration into SSO server it can use either http or https - depending on setting of SSO_DISABLE_SSL_CERTIFICATE_VALIDATION env var.

If a user wants to use https there is no easy way how to pass valid CA certificate into curl that communicates with SSO.

We propose to use trusted keystore if passed and extract a CA cert for it that is going to be used by the curl.