Alert: Avalara SSL certificate change on October 15th, 2018 may affect you

Avalara announced that they are changing the AvaTax SSL certificate on October 15, 2018.

https://help.avalara.com/Frequently_Asked_Questions/Avalara_AvaTax_FAQ/What_do_I_need_to_do_about_the_AvaTax_SSL_certificate_change_on_October_15%2C_2018%3F

Based on your Enterprise Management (X3) version and Syracuse patch level:

Version 6 Java Bridge for Avalara SST Node.js version for Avalara SST Result Action Required
All Patches Always for N/A Certificate error Update certificates using instructions below
Version 7 Java Bridge for Avalara SST Node.js version for Avalara SST Result Action Required
Patch 4 Always Not used for SST Certificate error Update certificates using instructions below
Patch 5 Always Not used for SST Certificate error Update certificates using instructions below
Patch 6 Always Not used for SST Certificate error Update certificates using instructions below
Patch 7 Never 0.10.33 Syracuse connection error Upgrade to at least V7P9 - see KB ID 93719
Patch 8 Never 0.10.33 Syracuse connection error Upgrade to at least V7P9 - see KB ID 93720
Patch 9 Never 0.10.38 Successful connection None
Patch 10 Never 0.10.38 Successful connection None
Patch 11 Never 0.10.38 Successful connection None
Patch 12 Never 0.10.38 Successful connection None
Patch 13 Never 0.10.42 Successful connection None
Patch 14 Never 0.10.42 Successful connection None
Patch 15 Never 0.10.46 Successful connection None
Patch 16 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
Patch 17 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
Patch 18 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
Product Update 8 Java Bridge for Avalara SST Node.js version for Avalara SST Result Action Required
8.0.2 Never 0.10.38 Successful connection None
8.0.3 Never 0.10.38 Successful connection None
8.0.4 Never 0.10.38 Successful connection None
8.0.5 Never 0.10.42 Successful connection None
8.0.6 Never 0.10.42 Successful connection None
8.0.7 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
8.0.8 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
8.0.9 Can be enabled 0.10.46 SYR success / JB certificate error If using JB, update certificate using instructions below
Product Update 9 Java Bridge for Avalara SST Node.js version for Avalara SST Result Action Required
9.0.2 Never 0.12.9 Syracuse connection error

Option 1: Upgrade application to at least 9.0.5 along with Syracuse to 9.5 and use JB only.

Option 2: Upgrade Syracuse component to 9.9 (from application 9.0.8)

9.0.3 Never 0.12.13 Syracuse connection error

Option 1: Upgrade application to at least 9.0.5 along with Syracuse to 9.5 and use JB only.

Option 2: Upgrade Syracuse component to 9.9 (from application 9.0.8)

9.0.4 Never 0.12.13 Syracuse connection error

Option 1: Upgrade application to at least 9.0.5 along with Syracuse to 9.5 and use JB only.

Option 2: Upgrade Syracuse component to 9.9 (from application 9.0.8)

9.0.5 Can be enabled 0.12.15 SYR error / JB certificate error If using JB only, update certificate using instructions below. Upgrade Syracuse to 9.9 (from application 9.0.8) 
9.0.6 Can be enabled 0.12.15 SYR error / JB certificate error If using JB only, update certificate using instructions below. Upgrade Syracuse to 9.9 (from application 9.0.8) 
9.0.7 Can be enabled 0.12.18 SYR error / JB certificate error If using JB only, update certificate using instructions below. Upgrade Syracuse to 9.9 (from application 9.0.8) 
9.0.8 (SYR9.9) Can be enabled 8.9.4 SYR success / JB certificate error If using JB, update certificates using instructions below.
V11 Java Bridge for Avalara SST Node.js version for Avalara SST Result Action Required
All patches Never 4.6.2 - 8.11.4 Successful connection None

You can conduct a ping test to Sage Sage Tax in GESXAY or GESLTP depending on Enterprise Management version

You may not be able to connect to Avalara using the Syracuse/node method without upgrading the Syracuse component.

Example of a Syracuse connection error (problem with outdated node version handling new certificates):

You may not be able to connect to Avalara without updating your certificate. You can also review "How do I update the certificates in the trustStore?" KB ID 93719 in the knowledgebase.

Example of a Java Bridge connection error (problem with certificate):

1. Download the appropriate certificate(s). For example as of October 15, 2018, you may need the certificates from Avalara's FAQ.

2. Open a Windows Command Prompt running as Administrator

3. Change the directory to the location of keytool.exe. (ie <JavaBridgeInstallationPath>\BridgeTools\SOFTS\JVM\bin\keytool.exe)

4. Locate the cacerts file for future reference (ie. <JavaBridgeInstallationPath>\BridgeTools\SOFTS\JVM\jre\lib\security\cacerts)

5. Add the root certificate 

a. Type keytool -import -alias root -keystore "<JavaBridgeInstallationPath>\BridgeTools\SOFTS\JVM\jre\lib\security\cacerts" -file "C:\temp\DigiCertGlobalRootG2-Root-Cert.cer" 

b. You will be prompted for a password. Type changeit and press ENTER

c. You will be prompted to trust this certificate. Type y and press ENTER

d. Result: Certificate was added to keystore

6. Add the intermediate certificate

a. Type keytool -import -alias intermediate -keystore "<JavaBridgeInstallationPath>\BridgeTools\SOFTS\JVM\jre\lib\security\cacerts" -file "C:\temp\GeoTrustTLSRSACAG1-Intermediate-Certificate.cer"

b. You will be prompted for a password. Type changeit and press ENTER

c. Result: Certificate was added to keystore

7. Restart the Java Bridge Windows service.

Now in version 6

In Product Update 9

  • Hi Casey. Thanks for the great info. Are we able to add the certs ahead of time or does this process overwrite the existing cert tree?

  • in reply to Rod Quenneville

    Yes you can add the certs ahead of time.

    In fact, Avalara provides test URLs to test the new certificates against.

    Production: https://avatax-test.avalara.net

    Development: https://development-test.avalara.net

    You will also note that in their grid and in their note (step 7) and under important dates, the test URLs will removed as of November 15th. So you can test against the test URL, but you need to set it back the regular URL.

    In the meantime, both should work until November 15, 2018.