An administrator is integrating a new PingAccess Proxied Application for which the target site uses a certificate issued by a publicly trusted…

PingAccess, as a Java-based application, includes a default trust store (the Java Trust Store) which contains the root certificates of most major public Certificate Authorities (CAs). PingAccess exposes this as a pre-configured "Java Trust Store Certificate Group". When a backend target site uses a certificate issued by a publicly trusted CA, no manual certificate import is necessary. The administrator simply needs to configure the Site in PingAccess to use this built-in trust group, which allows PingAccess to validate the target's certificate chain against the already-trusted public CAs.

A. Import the certificate chain into Key Pairs and add it to a Trusted Certificate Group:

Key Pairs are used for PingAccess's own identity (e.g., for listeners or mutual TLS), not for trusting certificates presented by backend sites.

C. Import the certificate chain into Key Pairs:

This is incorrect for the same reason as option A. Key Pairs are for PingAccess's own private keys and certificates, not for storing trusted CA certificates.

D. Drop the certificate chain into a Trusted Certificate Group:

This action is unnecessary. Since the certificate is from a publicly trusted CA, its root is already present in the default Java Trust Store, making manual import redundant.

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Trusted Certificate Groups

Reference: "PingAccess provides a default trusted certificate group, the Java Trust Store, which contains a set of default trusted certificate authorities. You can also create your own trusted certificate groups and import certificates into them." This confirms the existence and purpose of the Java Trust Store group for default public CAs.

2. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Add a site

Reference: In the "Add a Site" configuration steps, under the "Secure" option, the guide states: "If you enable this option, you must also select a trusted certificate group from the Trusted Certificate Group list." This shows that the correct procedure is to select an existing group, and for public CAs, the appropriate choice is the "Java Trust Store" group.

3. Ping Identity PingAccess 7.3 Administrator's Guide, Section: Key Pairs

Reference: "Key pairs are used to identify PingAccess to clients. For example, you can assign a key pair to a virtual host to secure communication between a client and PingAccess." This documentation explicitly defines the purpose of Key Pairs as being for PingAccess's own identity, distinguishing them from Trusted Certificate Groups used to trust others.