Change Preparation

Oracle Java Application

Note: These instructions assume your application is running in a dedicated Java virtual machine. It is possible that your Java web server software may be in management of the SSL trust store for your application. If you use a web server software package (such as IBM Websphere or Oracle WebLogic), please consult the vendor documentation for further information, as those products may control the SSL trust store.

Check Java Version

The latest Java releases already include the DigiCert Global Root G2 certificate. If your system is running a current Java version, no action is required.

• If you are unsure, upgrade to the latest supported Java version.

• If upgrading is not an option, validate that your Java trust store contains the required root certificate.

Validate the trust store

By default, Java uses the cacerts trust store. Confirm whether the DigiCert root certificate is present:

1. Locate the trust store file used by your application.

   • JDK: JDK\jre\lib\security\cacerts

   • JRE: JRE\lib\security\cacerts

2. Open a command window and run:

Example (default JDK install):

3. If the certificate is listed, no action is required.
   If you see the error “Alias <digicertglobalrootg2> does not exist”, install the certificate:

• When prompted, type yes and press Enter

• Verify installation:

Important: For this change to come into effect, you may need to restart your application server and/or any middleware software.

Microsoft .NET Application

You can check that Windows has installed the new Digicert Root CA correctly on your server as follows:

1. Login to the server as an administrator.

2. Click Start → Run and enter mmc and press Enter.

3. Under the File → Add/Remove Snap-in...

4. Select Certificates → Add → Computer account → Next.

5. Select Local computer → Finish → OK.

6. Under Console Root, expand Certificates (Local Computer) → Trusted Root Certification Authorities → Certificates.

7. Confirm that a certificate is present with Issued To = DigiCert Global Root G2.

If the certificate is present, no action is required. If the CA certificate is not present, you must install it as follows:

1. Download the Digicert Root CA certificate and save it to your server with a .cer file extension.

2. In the MMC window, under Trusted Root Certification Authorities, right-click the Certificates folder → All Tasks -> Import...

3. Follow the the Certificate Import Wizard to import the certificate

4. Confirm the certificate now appears under Trusted Root Certification Authorities → Certificates.

Important: For this change to come into effect, you may need to restart your application and the IIS service.

Other Application Technologies

If your application platform is not Java or .NET, you must check whether it trusts the DigiCert Global Root G2 certificate. Consult your application vendor, system administrator, or development team for specific instructions.

Common Issues

My application is producing SSL/TLS errors post this change

If the error looks like the following samples for .NET or Java, this is an indication an application instance is reporting a certificate issuance validation error and is an indication the change was not successful.

Java:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

.NET

System.Net.WebException: The underlying connection was closed: Could not establish trust

relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException:

The remote certificate is invalid according to the validation procedure.

Java - When using keytool to add the Root Certificate to my Java trust store, I get an error 'Input is not an X.509 certificate'

• This error is generated when a browser produces a file which has improperly formatted the file. If there is any trailing whitespace, then keytool will refuse to import the file.

• Check that there is no trailing whitespace on any of the lines and that the -----END CERTIFICATE----- line is on a line at the bottom.

• Note that when this is added, a restart of the application may be required to pick up the change

.NET - I have installed the Root Certificate by logging into the server with my user and installing the certificate under my user account

• It is possible the certificate has not been installed under the Local Computer trust store or the trust store used by the application

• Please refer to our suggested instructions to install the Root Certificate under the Local Computer trust store

• Note that when this is added, a restart of the application may be required to pick up the change

Frequently Asked Questions

Do I need to change the client certificate I use with your web services?

No. This change does not affect client certificates.

How do I validate whether my application includes the required Digicert Root Certificate?

Please see the general change preparation information above for Java and .NET.

How do I perform this validation for my application when I don't use Java or .NET?

Qvalent cannot provide detailed instructions for all application technologies. Please consult your application development team and/or server team for instructions for your specific application and server environment.

We have provided general instructions for common Java and .NET applications above as a sample of the change.

Does this change affect other hosts?

No, this change only affects the mentioned hosts on the change document at this time.

Can I be granted an extension for this change?

No, extensions are not possible. Due to the nature of this change, all customers must be prepared for this change by the scheduled date.