LDAPS certificate validation in Confluence 8.0 drops default cacerts fallback

Confluence 8.0 changed outbound TLS validation for LDAPS connections so that certificates in the default Java cacerts truststore are no longer trusted automatically. Self-signed certificates that worked in earlier versions now fail directory synchronization unless the certificate is imported into a Confluence-specific truststore or a custom truststore is referenced through the JVM.

Administrators deploying Confluence 8.0 or later with self-signed LDAP certificates need to decide where the truststore path belongs in the startup configuration. The documentation requires the -Djavax.net.ssl.trustStore argument, but it does not clearly state whether this should be placed in the setenv.sh or setenv.bat file or defined directly in the JAVA_OPTS environment variable. Because an incorrect truststore configuration can disrupt all LDAP-based logins and group synchronization, the placement of this setting is a deployment-critical boundary rather than a cosmetic preference.

Which startup mechanism is the supported location for the -Djavax.net.ssl.trustStore argument in Confluence 8.0+ when using self-signed LDAPS certificates? Does the choice between setenv scripts and the JAVA_OPTS environment variable affect how the truststore is loaded during a service restart?