Restricting JSSE TrustManager acceptance to specific issuers without a custom TrustManager

I am configuring TLS for a Java 17 client that connects to several internal services, and I want the default JSSE certificate validation to accept only chains issued by one specific internal CA rather than any anchor present in the trust store.

My understanding is that the default TrustManager accepts any chain that terminates at a configured trust anchor, with no built-in policy boundary for issuer, domain, or certificate policy. The trust store is shared with other components on the same JVM, so simply removing anchors is not an option. I would prefer to avoid a custom X509TrustManager because the runtime is locked down and I am unsure whether the required security permissions for overriding trust decisions are granted there.

Is there a supported way to scope trust to a single issuer using a per-connection SSLContext or a dedicated trust store, without touching the JVM-wide cacerts file?

Can hostname verification (endpoint identification) be combined with issuer restriction so both are enforced by standard JSSE mechanisms rather than custom code?

If a custom TrustManager is unavoidable, what is the minimal safe delegation pattern to the platform default so SAN-first hostname checking is preserved?