BaseCertLoginModule uses a JaasSecurityDomain to validate the certificates. Currently it only uses the configured keystore for this. We need to allow the truststore to be checked by default and fallback to the keystore if the truststore is not configured.