https://www.baeldung.com/java-custom-truststore article with a very similar code approach. Suggests another simple option: merge the system keystore with yours. (presumably needs to be re-run after system updates)