The simple answer here is to request that the service provider fix their certificate problem. The root of your issue is that the security mechanisms built into Pega and Java are reacting correctly to issues with the certificate presented by the service.

Thanks for the comment HOULJ, if only it were that simple. That was the first choice, but the impact to other applications and certificates means that is not an option. Appreciate that checking the CRL is standard security practice, but some app/web servers have the ability to turn this feature off, specifically Tomcat in this instance. However, this seems to have been overwritten within Pega.

I'm looking for ideas on how we can turn off this feature in Pega, either through using existing attributes/flags such as the ones used by Tomcat, or through changing the behaviour of the way the Private API calls the TrustManager.

Thanks.