Hello @moritzwiechers,
first of all, sorry for the very late answer. I created 2 tickets for the two additional points that you mentioned at the end of the post:
Support default truststore location
As for the main point you are discussing, we are trying to keep the same requirements as the scanner cli without adding any additional configuration exclusive to the npm scanner. So accepting pem certificates which are only used by the NPM scanner but ignored by the scanner cli is not something that fits that vision. Keeping this in mind, what would be your preferred solution to simplify the user experience (while keeping the Java truststore as “source of truth” for certs)
Cheers,
Victor