Recently I have faced an issue where one of our provider changed SSL and they disabled supporting of TLS 1.0 (as far as I understand it's non secure ourdays) and TLS 1.2 should be used instead. As a result our java agents (which used HttpsURLConnection) could not connect anymore to provider.
Error message looked like this:
Caused by: java.security.AccessControlException: Access denied (javax.net.ssl.SSLPermission setHostnameVerifier)
I have found 2 possible solutions:
Enable TLS 1.2 on Domino (applicable only for 9.0.1 FP3 IF2 and higher)
The Domino JVM is based on Java 1.6 and default settings configured in a way to use TLS 1.0. Luckily our Domino servers had version 9.0.1 FP4 (and TSL 1.2 support has been added since FP3 IF2). So our version was capable to work with 1.2 (in theory) but it took some time to make it work.
In order to configure Domino JVM to use TLS 1.2 you need to:
- Create JVM settings file, f.x. C:\Domino\jvmOptions.ini
- Add parameter in jvmOptions.ini
https.protocols=TLSv1.2
- Add path to jvmOptions.ini file in notes.ini
JavaUserOptionsFile=C:\Domino\jvmOptions.ini
After you added settings don't forget to restart Domino server. Keep in mind that setting is global meaning all agents that will start to use TLS1.2 therefore it is definitely worth to verify everything before and after this fix.
Java library solution
If that is not a way you can go with (f.x. Domino has lower version or something won'f work if you switch to TLS 1.2) then it's still possible to make custom Java Library that will make it possible, see link:
How to use TLS 1.2 in Java 6.
It worked for me as well, but it requires to give permission in java policy on Domino server.