SSL Trust Errors – Client Support

8th May 2018

We have reissued our ssl certificates following the symantic announcement:

https://www.symantec.com/connect/blogs/information-replacement-symantec-ssltls-certificates

The impact of that means users of Google Chrome and soon other browers will start seeing warnings about security problems on old certificates using the old symantec roots. As root/trust certificates are finitie some few systems will need manual update their root certificates to ensure smooth operation going forward when using Panther APIs. This update should be automatic but sometimes (and in particular on JAVA applications), manual updates are needed.

If you are trying to use our APIs via https and are getting errors similar to this:

javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error

… our load balancer is providing the full certificate chain without issue so errors like above indicate our application is not configured to bring new root certificates during ssl negotiation, meaning that root certificates accepted by the application are manually controlled within the application.

In order to fix this issue, the developers of your application will have to add the root certificate from Thawte (Digicert) that is used by Panther’s SSL certificate. The root certificate is below, simply adding this to your trusted root certificates should resolve the problem: