In the in-built implementation the end-users have to imports the certificates directly into java's cacerts. This is usually problematic as users may move to a different system and their ldap authentication stops working suddenly. The issue also comes if their switch to a different version of java. They need to re-import all the certs. Since this is moving to a plugin, could we provide an option in auth-config for the plugin to specify the certs in order to avoid the same issue that we have with the in-built one.