Confluence Server and External API TLS Certificate Truststore Integration

Confirm whether Confluence Server or Data Center validates outbound TLS connections to external APIs using the JRE cacerts truststore, the operating system certificate store, or both. The integration boundary involves Confluence initiating HTTPS requests to a third-party service while the Base URL setting may resolve to a different hostname internally than externally.

Confluence inherits host DNS configuration from the underlying operating system, and the JVM may cache DNS records according to networkaddress.cache.ttl. Certificate failures typically appear as SSLHandshakeException or PKIX path building failed messages, but it is unclear which truststore entry governs the hostname check when internal loopback resolution differs from the public DNS record.

Which truststore does Confluence consult for outbound certificate validation? Is the certificate hostname verified against the Base URL value, the resolved IP address, or the external DNS name? Does a DNS TTL change require restarting Confluence to take effect for existing application links?