Typically services can set the JSSE system properties at run time to obtain the various keystores and trust stores, ciphers, etc....

There can be situations when the AS as a whole should be using just one keystore and truststore for all the services. Essentially, ignoring any of the JSSE system property circus the services may be doing.

For this to happen, we need a MC bean (a trust manager implementation) that takes in configurable keystore/truststore locations and is installable in boostrap/security.xml on demand. This trust store should be delegating all queries to the base JDK trust manager.