Which keystore would a vSphere Replication administrator use to manually add an additional Certificate Authority certificate?

hms-truststore.jks is the Java KeyStore used by the vSphere Replication HMS (Host Management Service) specifically to hold trusted Certificate Authority certificates. When an administrator needs to manually trust an additional CA - for example to satisfy custom PKI requirements - this is the file that must be updated. It is distinct from the keystore that holds the service's own identity certificate.

hms-keystore.jks holds the HMS service's own private key and signed certificate, not trusted CA certificates.

certificates.ks is not a recognized or standard keystore file name in vSphere Replication's trust infrastructure.

cacerts.ks is not a standard vSphere Replication keystore; the JDK default CA store is named cacerts but is not the file administrators use for this task in vSphere Replication.