In cacerts.jks there are multiple "trusted" root CA's. If you create a new keystore with only your root CA in it and point glassfish using this keystore as truststore it will accept only certificates signed by your root CA.
Johan
[Message sent by forum member 'jcstover' (jcstover)]
http://forums.java.net/jive/thread.jspa?messageID=318972