---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Integration]
keyword: [Extend, Orchestration Builder, Orchestrate, Orchestration]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Reference: Keystores and Truststores
layout: subsection
---

## <a id="section_1"></a>JKS_KEYSTORE

<table><thead></thead><tbody><tr><td><b>Purpose</b></td><td>Enables Mutual TLS authentication using the default Workday truststore for server certificate validation.</td></tr><tr><td><b>Token Data Structure</b></td><td><ul><li>Base64-encoded string of a ZIP archive containing a single keystore file in JKS format.
</li><li>The keystore must contain exactly 1 entry of type PrivateKeyEntry.
</li><li>Contains the client's private key and certificate chain.
</li></ul></td></tr><tr><td><b>File Structure</b></td><td><p>credential.zip with this content:</p><ul><li>client-keystore.jks (containing PrivateKeyEntry with client cert + private key)
</li></ul></td></tr><tr><td><b>When to Use</b></td><td><ul><li>Third-party requires mutual certificate authentication.
</li><li>The server only allows authentication against certificates from a private Certificate Authority.
</li></ul></td></tr></tbody></table><br/>

## <a id="section_2"></a>JKS_TRUSTSTORE

<table><thead></thead><tbody><tr><td><b>Purpose</b></td><td>Enables one-way TLS with a custom Certificate Authority truststore when the server uses certificates not in Workday's default truststore.</td></tr><tr><td><b>Token Data Structure</b></td><td><ul><li>Base64-encoded string of a ZIP archive containing a single truststore file in JKS format.
</li><li>Contains trusted certificates for validating server certificates.
</li></ul></td></tr><tr><td><b>File Structure</b></td><td>credential.zip with this content: <ul><li>custom-truststore.jks (containing trusted CA certificates)
</li></ul></td></tr><tr><td><b>When to Use</b></td><td><ul><li>Third-party server uses self-signed certificates.
</li><li>Server's root Certificate Authority A is not in Workday's default truststore.
</li><li>No client certificate authentication required.
</li></ul></td></tr></tbody></table><br/>

## <a id="section_3"></a>JKS_KEYSTORE_TRUSTSTORE

<table><thead></thead><tbody><tr><td><b>Purpose</b></td><td>Enables full mutual TLS authentication with both client certificate presentation and custom server certificate validation.</td></tr><tr><td><b>Token Data Structure</b></td><td><ul><li>Base64-encoded string of a ZIP archive containing two files:

<ul><li>Keystore file (JKS format) with client credentials.
</li><li><p>Truststore file (JKS format) with trusted CA certificates.</p></li></ul></li><li>Keystore must contain exactly 1 PrivateKeyEntry.
</li></ul></td></tr><tr><td><b>File Structure</b></td><td><p>Note: order is critical here. The keystore must be the first entry in the archive, followed by the truststore.</p> <p>credential.zip with this content:</p><ul><li>client-keystore.jks (containing PrivateKeyEntry with client cert and private key)
</li><li>custom-truststore.jks (containing trusted CA certificates)
</li></ul></td></tr><tr><td><b>When to Use</b></td><td><ul><li>Third-party requires mutual certificate authentication.
</li><li>Server uses certificates not in Workday's default truststore.
</li><li>Full bidirectional certificate validation needed.
</li></ul></td></tr></tbody></table><br/>

### Related Information

[Configure Mutual HTTP Authentication](/wcp_docs/GUID-b15a4eef-bb91-4794-b6c1-bbdddb9b05da-enHYPHENus.html)