Recently there was a move to implement TLS1.2. All of a sudden we started seeing lot of SSL related errors and here is the fix for those errors.
1. You can change the registry value manually (Recommended for experts)
or
2. Use the following patch from Microsoft.
https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-a-default-secure-protocols-in
If you are using Symantec/Verisign certificate and getting errors around last quarter of 2015 then it is the result incorrect certificate chain.
This can be fixed in the following ways.
1. Obtain the intermediate certificate “VeriSign Class 3 Public Primary Certification Authority” from Symantec and import it to the “Intermediate Certification Authorities” Store.
2. Also obtain the root “Versign Class 3 Public Primary Certification – G5” certificate from Symantec and import it to the “Trusted Root Certification Authority” Store.
OR
There is also an alternate solution available, which suggests de-activating of automatic certification updates, and importing the above certificates.
There are pros and cons of each method. So please choose the solution which suits you the best.
If you are using Symantec/Verisign certificates and seeing the “Incomplete FCPath” error around last quarter of 2015 then it is the result incorrect certificate chain. This type of error occurs with KeyStores. The following is the recommended fix to over come the problem.
1. Obtain the intermediate “Symantec Class 3 Secure Server CA – G4” certificate from Symantec and import it to the trust KeyStore.
2. Also obtain the root “Versign Class 3 Public Primary Certification – G5” certificate from Symantec and import it to the trust KeyStore.
Make sure that the KeyStore is in correct path.
The above solution will fix the error.
Similar problem also exists for windows based servers and the solution is little different.
/* The following code is used for symmetric encryption */
/*Open Key Store */
public KeyStore openKeyStore(String KeyStoreName, String keyStorePassword){
KeyStore ks = KeyStore.getInstance(“JCEKS”);
fis = new java.io.FileInputStream(KeyStoreName);
ks.load(fis, keyStorePassword.toCharArray());
return ks;
}