Trusted SSL Certificates for Java Runtime

When loading web resources via a secured https connection, the website's Security Certificate must be available (known and trusted) to Java Runtime Engine used by Orbit.
Oracle includes certificates from widely recognized Certificate Authorities with a significant customer base and global reach.
Orbit embeds the most recent JRE available at the release of a new version.

More information about Security Certificates and Java Keystore :

• https://www.oracle.com/technetwork/java/javase/javasecarootcertsprogram-1876540.html
• https://en.wikipedia.org/wiki/Keystore
• https://en.wikipedia.org/wiki/Certificate_authority

Occurs when loading an insecure connection in a secured session.

Occurs when the Website/Webservice certificate is not known by Java. Thus the expected secured connection cannot be guaranteed, a SSL handshake error will prevent successful connection.

When a users proxy/firewall offloads secured communication to repackage network traffic with its own user SSL certificate, ensure the user proxy uses a valid, officially authorized certificate. User self-signed certificates are, for well know reasons, not trusted and need to be added explicitly by the user to the Java Keystore to be trusted and enable connectivity.

Following exception is printed in the Orbit logfile if a certificate is missing :

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException: PKIX path building failed
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Steps to add a certificate to the Java Keystore used by Orbit.

Browse to the secured website and download the end-entity certificate via the browser's certificates manager.

• File format: DER-encoded binary, single certificate (*.der)

From the command line.

Go to Orbit's jre/bin directory.
On Windows, <Orbit Installation Directory>/program/jre/bin/

Execute following command :

keytool -import -alias <Alias> -keystore ..\lib\security\cacerts -file <File Directory>\<Filename>.der

• Alias : free of choice
• Password : default, changeit, requested after prompt.

After confirmation and entering the password the message Certificate was added to keystore should be printed.