As in their JavaDoc (http://hc.apache.org/httpcomponents-client-ga/httpclient/apidocs/org/apache/http/conn/ssl/SSLSocketFactory.html#getSystemSocketFactory()) they will follow http://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html which mandates that if javax.net.ssl.trustStore is not present it will fallback to cacerts