Online refresh with https://www.ssi.gouv.fr/uploads/tl-fr.xml raises [Received fatal alert: protocol_version] about dss-demonstrations HOT 5 CLOSED

I'm glad it helped!

PS: https://www.digst.dk/TSLDKxml seems (temporary) down

Indeed, we are aware about that. Problem is on DK side.

Best regards,
Aleksandr.

from dss-demonstrations.

Hello,

The issue occurs due to FR TLSO update to the version TLSv1.3 of the SSL protocol. You may either enforce the "TLSv1.3" within CommonsDataLoader used in TLValidationJob for online refresh or you may try to update to the freshly released 5.12.RC1 version of DSS.
See also #166, DSS-2949, DSS-2948 and ESIGSD-1044 for more information.

Best regards,
Aleksandr.

from dss-demonstrations.

Hi, thanks for your quick answer.

I adjusted the CommonsDataLoader with TLSv1.3 but now I raises:
2023-03-01 09:42:20,405 ERROR | pool-1-thread-14 | eu.europa.esig.dss.tsl.runnable.AbstractAnalysis | Unable to process GET call for url [https://www.ssi.gouv.fr/uploads/tl-fr.xml]. Reason : [PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

from dss-demonstrations.

This error means the Java keystore does not trust the SSL certificate from this URL address. You should add the corresponding certificate to the cacerts file within the used JVM.
See 11.1.11.1. Java Keystore Management from the documentation for more information how to resolve the problem.

For your convenience I attach the CA certificate you should add to the keystore (archived).

Best regards,
Aleksandr.

Certigna_Services_CA.zip

from dss-demonstrations.

Ok thanks for your help !
Now "France" is working; great idea to enforce TLS 1.3 and using a Root CAs not by default in the (current) Java Root Stores.

PS: https://www.digst.dk/TSLDKxml seems (temporary) down

from dss-demonstrations.