Generally speaking, you cannot (this is very similar to this question ).
In the JSSE API, certificate trust is not actually defined by the trust store, but. Although it is often initialized with a truststore, it is not necessary. In addition, the repositories themselves should not be files . There is nothing in the default trust API to check where and how the potential trust store is used.
There SSLSocketis nothing that allows you to return to it SSLSocketFactory, and nothing where you can return to the original SSLContext, and nothing there that allows you to get trustees.
/ , . , , , SSLContext, javax.net.ssl.*. SSLContext ( , Tomcat , ).
Java 6, () SSLContext ( SSLContext.setDefault(...).
, JSSE. . -Djavax.net.debug=SSL,trustmanager , , API.
(, -Djavax.net.ssl.keyStore , ).