* certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to
 * the TLS handshake and to extract the trusted CA certificate for the benefit of certificate
 * pinning.
 */
abstract class CertificateChainCleaner {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.config.cbean.ca;

import org.codelibs.fess.opensearch.config.cbean.ca.bs.BsElevateWordToLabelCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class ElevateWordToLabelCA extends BsElevateWordToLabelCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.config.cbean.ca;

import org.codelibs.fess.opensearch.config.cbean.ca.bs.BsRelatedContentCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class RelatedContentCA extends BsRelatedContentCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.config.cbean.ca;

import org.codelibs.fess.opensearch.config.cbean.ca.bs.BsBadWordCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class BadWordCA extends BsBadWordCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.config.cbean.ca;

import org.codelibs.fess.opensearch.config.cbean.ca.bs.BsElevateWordCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class ElevateWordCA extends BsElevateWordCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.log.cbean.ca;

import org.codelibs.fess.opensearch.log.cbean.ca.bs.BsClickLogCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class ClickLogCA extends BsClickLogCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.log.cbean.ca;

import org.codelibs.fess.opensearch.log.cbean.ca.bs.BsFavoriteLogCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class FavoriteLogCA extends BsFavoriteLogCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.user.cbean.ca;

import org.codelibs.fess.opensearch.user.cbean.ca.bs.BsGroupCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class GroupCA extends BsGroupCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.opensearch.log.cbean.ca;

import org.codelibs.fess.opensearch.log.cbean.ca.bs.BsUserInfoCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class UserInfoCA extends BsUserInfoCA {

For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

If TLS is not enabled, you would need only the third party CA:

```