diff --git a/src/main/java/org/cryptomator/networking/SSLContextWithWindowsCertStore.java b/src/main/java/org/cryptomator/networking/SSLContextWithWindowsCertStore.java
index 5a179e56e..83815b611 100644
--- a/src/main/java/org/cryptomator/networking/SSLContextWithWindowsCertStore.java
+++ b/src/main/java/org/cryptomator/networking/SSLContextWithWindowsCertStore.java
@@ -2,6 +2,7 @@ package org.cryptomator.networking;
 
 import org.cryptomator.common.Nullable;
 import org.cryptomator.integrations.common.OperatingSystem;
+import org.jetbrains.annotations.VisibleForTesting;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -14,6 +15,7 @@ import java.security.NoSuchAlgorithmException;
 import java.security.Provider;
 import java.security.cert.CertificateException;
 import java.util.List;
+import java.util.Properties;
 
 /**
  * SSLContextProvider for Windows using the Windows certificate store as trust store and the bundled JDK cacerts as fallback
@@ -47,8 +49,15 @@ public class SSLContextWithWindowsCertStore extends SSLContextDifferentTrustStor
 
 	@Nullable
 	KeyStore getShippedCaCertsStore() {
-		var javaHome = Path.of(System.getProperty("java.home"));
-		var trustStorePassword = System.getProperty("javax.net.ssl.trustStorePassword", DEFAULT_TRUSTSTORE_PASSWORD).toCharArray();
+		return getCaCertsStoreByProperties(System.getProperties());
+	}
+
+	//for testability
+	@VisibleForTesting
+	@Nullable
+	KeyStore getCaCertsStoreByProperties(Properties props) {
+		var javaHome = Path.of(props.getProperty("java.home"));
+		var trustStorePassword = props.getProperty("javax.net.ssl.trustStorePassword", DEFAULT_TRUSTSTORE_PASSWORD).toCharArray();
 		for (var candidate : List.of(javaHome.resolve("lib/security/cacerts"), javaHome.resolve("conf/security/cacerts"))) {
 			try {
 				if (Files.isRegularFile(candidate)) {
diff --git a/src/test/java/org/cryptomator/networking/SSLContextWithWindowsCertStoreTest.java b/src/test/java/org/cryptomator/networking/SSLContextWithWindowsCertStoreTest.java
new file mode 100644
index 000000000..dca3c3ced
--- /dev/null
+++ b/src/test/java/org/cryptomator/networking/SSLContextWithWindowsCertStoreTest.java
@@ -0,0 +1,97 @@
+package org.cryptomator.networking;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyStore;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.util.Properties;
+
+public class SSLContextWithWindowsCertStoreTest {
+
+	private static final String JAVA_HOME_PROP = "java.home";
+	private static final String TRUSTSTORE_PASSWORD_PROP = "javax.net.ssl.trustStorePassword";
+
+	@TempDir
+	Path tmpDir;
+
+	@Test
+	public void testGetCaCertsStoreByPropertiesReturnsNullIfNoCandidateExists() {
+		var props = propsFor(tmpDir, null);
+
+		var inTest = new SSLContextWithWindowsCertStore();
+
+		Assertions.assertNull(inTest.getCaCertsStoreByProperties(props));
+	}
+
+	@Test
+	public void testGetCaCertsStoreByPropertiesLoadsLibSecurityCacertsByDefault() throws Exception {
+		var cacerts = tmpDir.resolve("lib/security/cacerts");
+		writePkcs12Keystore(cacerts, "changeit".toCharArray());
+		var props = propsFor(tmpDir, null);
+
+		var inTest = new SSLContextWithWindowsCertStore();
+
+		Assertions.assertNotNull(inTest.getCaCertsStoreByProperties(props));
+	}
+
+	@Test
+	public void testGetCaCertsStoreByPropertiesTriesSecondCandidateAfterFirstFails() throws Exception {
+		var invalidLibCacerts = tmpDir.resolve("lib/security/cacerts");
+		Files.createDirectories(invalidLibCacerts.getParent());
+		Files.writeString(invalidLibCacerts, "not a keystore");
+		var confCacerts = tmpDir.resolve("conf/security/cacerts");
+		writePkcs12Keystore(confCacerts, "changeit".toCharArray());
+		var props = propsFor(tmpDir, null);
+
+		var inTest = new SSLContextWithWindowsCertStore();
+
+		Assertions.assertNotNull(inTest.getCaCertsStoreByProperties(props));
+	}
+
+	@Test
+	public void testGetCaCertsStoreByPropertiesReturnsNullOnWrongPassword() throws Exception {
+		var cacerts = tmpDir.resolve("lib/security/cacerts");
+		writePkcs12Keystore(cacerts, "changeit".toCharArray());
+		var props = propsFor(tmpDir, "wrong-password");
+
+		var inTest = new SSLContextWithWindowsCertStore();
+
+		Assertions.assertNull(inTest.getCaCertsStoreByProperties(props));
+	}
+
+	@Test
+	public void testGetCaCertsStoreByPropertiesUsesCustomPasswordProperty() throws Exception {
+		var cacerts = tmpDir.resolve("lib/security/cacerts");
+		writePkcs12Keystore(cacerts, "custom-password".toCharArray());
+		var props = propsFor(tmpDir, "custom-password");
+
+		var inTest = new SSLContextWithWindowsCertStore();
+
+		Assertions.assertNotNull(inTest.getCaCertsStoreByProperties(props));
+	}
+
+	private static void writePkcs12Keystore(Path target, char[] password) throws CertificateException, IOException, NoSuchAlgorithmException, java.security.KeyStoreException {
+		Files.createDirectories(target.getParent());
+		var keystore = KeyStore.getInstance("PKCS12");
+		keystore.load(null, null);
+		try (var out = Files.newOutputStream(target)) {
+			keystore.store(out, password);
+		}
+	}
+
+	private static Properties propsFor(Path javaHome, String truststorePassword) {
+		var props = new Properties();
+		props.setProperty(JAVA_HOME_PROP, javaHome.toString());
+		if (truststorePassword != null) {
+			props.setProperty(TRUSTSTORE_PASSWORD_PROP, truststorePassword);
+		}
+		return props;
+	}
+
+}