If your service is going to call other services in CapitalOne, esp. the DevEx gateway, your JVM
will have to trust hosts within capitalone.com. The usual way that devs do this is simply to get
the Capital One root cert from another dev, and import it into their $JAVA_HOME.../cacerts. This is
unwise for EC2 instances. Your cacerts
is probably cluttered with other certs, and for deployment,
you'd really like know exactly what you're doing, not throw files onto an instance and hope they work.
The better practice would be to create a truststore that has no more information in it than your application needs. Create an empty truststore: