@MorganMcEvoy what is cluster-head.domain.com? Is this a load balancer or an individual HS2 node? Also, what's the client tool you are using?  Is it possible that it is not honoring the sslTrustStore parameter?  A workaround would be to import the root ca cert into the default java truststore in the client machine. ref: https://stackoverflow.com/questions/11700132/how-to-import-a-jks-certificate-in-java-trust-store ... View more