Our engineering team investigated reports of SSL handshake errors when making API queries to Salsify from Java clients.
As part of the mandatory refresh of our SSL certificates, some customers were affected by a change that Amazon, as our certificate provider, made in their practice as a certificate authority.
On 2/14, Amazon updated the SSL cert for *.salsify.com.
Amazon has stopped cross-signing their certs with Starfield Class 2, operated by GoDaddy. As a result, clients which relied on that trust relationship will no longer be able to complete the SSL handshake with https://app.salsify.com. To resolve this, you must either:
1. Update your application's list of trusted root CAs to include Amazon's Root CA 1 certificate, using the certificate found here: https://www.amazontrust.com/repository/
In particular, Java runtimes prior to Java 9 (except Java 8 Update 25 or later and Java 7 Update 75 or later) would need to be updated to a newer version of Java or have their list of trusted root CA's updated.
Our engineering team has been investigating reports of SSL handshake errors when making API queries to Salsify from Java clients.
As part of the mandatory refresh of our SSL certificates, some customers may be affected by a change that Amazon, as our certificate provider, has made in their practice as a certificate authority.
On 2/14, Amazon updated the SSL cert for *.salsify.com. Amazon has stopped cross-signing their certs with Starfield Class 2, operated by GoDaddy. As a result, clients which relied on that trust relationship will no longer be able to complete the SSL handshake with https://app.salsify.com. To resolve this, you must either:
1. Update your application's list of trusted root CAs to include Amazon's Root CA 1 certificate, using the certificate found here: https://www.amazontrust.com/repository/
2. Update your application to run on a runtime which already supports Amazon's Root CA 1 certificate.
In particular, Java runtimes prior to Java 9 (except Java 8 Update 25 or later and Java 7 Update 75 or later) would need to be updated to a newer version of Java or have their list of trusted root CA's updated.