Java Integration Failures After SAP BTP’s DigiCert G5 Root Certificate Adoption – A Practical Fix

[ysimalatsar]

Background

Around seven days ago, SAP replaced its old root certificate, DigiCert Global Root G2, with DigiCert Global Root G5. This change was part of a regular security renewal on SAP’s side — but it caught many Java based applications off guard.

Operating system level trust stores were updated in line with instructions received. But...
While browsers and Windows applications updated their trust automatically, Java runtimes did not.
That’s where things got interesting.

The Symptom

One of our external systems, running on Red Hat OpenJDK — suddenly stopped sending messages to SAP ECC via BTP Integration Suite.

The log showed this familiar (but dreaded) exception:

 

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Classic SSL trust failure — and in this case, caused by a missing root certificate.

The Analysis

The new DigiCert Global Root G5 certificate was trusted by Windows but missing in the OpenJDK truststore (cacerts).

Unlike browsers or OS components, this particular JRE maintains its own internal truststore — it doesn’t inherit the operating system’s trusted certificate authorities.

So while everything else trusted the new SAP certificate, the Java runtime didn’t recognize it — and refused to connect.

The Practical Fix

1️⃣ Backup the existing truststore

cd <path_to_redhat_openjdk>\jre\lib\security copy cacerts cacerts.bak

2️⃣ Download the DigiCert Global Root G5 certificate

Get it directly from DigiCert’s official repository:
https://knowledge.digicert.com/generalinformation/digicert-root-and-intermediate-ca-certificates

Save it as g5.cer.

3️⃣ Import the certificate into Java’s truststore

..\..\bin\keytool -importcert -file g5.cer -keystore cacerts -alias "DigiCertG5" 

Default password: changeit
Confirm when prompted.

4️⃣ Verify the import

..\..\bin\keytool -list -keystore cacerts -storepass changeit | find "DigiCertG5"

5️⃣ Restart your application

Restart any Java processes using that truststore.

✅ Result: SSL handshake succeeded.
✅ Message flow from JAVA APP → BTP IS → SAP ECC restored.

Lessons Learned

1. Java ≠ Browser.
   Java doesn’t automatically inherit trusted roots from your OS.

2. Certificate renewals ripple.
   Cloud platforms like SAP BTP periodically renew CAs — and your Java apps might silently fail afterward.

3. Test from the runtime, not Chrome.
   Always validate SSL using the same Java runtime your integration runs on.

4. Keep a “trust refresh” procedure.
   Maintain a documented, repeatable way to update and verify truststores.

5. Automate where possible. If you manage multiple runtimes, script the import and verification steps.

 

The Bigger Picture

Integration is all about trust — both technically and organizationally.
A single missing certificate can bring down a perfectly built integration chain.

This incident was a reminder: even when nothing changes in your code, something always changes in the environment. And sometimes, that enough to break trust.