We finally got it working. It turns out that it was looking at the personal "keystore" instead of the trusted store, "cacerts". Even though we set the trusted store in the System environment, it simply ignored that setting. As soon as we put the certs into the keystore it worked. I don't get it....
Both the keystore and the trusted store are set in the JVM options of Glassfish. We'll have to experiment to see why it chooses the keystore over the trusted store.
[Message sent by forum member 'sjazama']
http://forums.java.net/jive/thread.jspa?messageID=483330