Fixing Java SSL Handshake Errors

Fixing the SSL Handshake Error on Windows

The Windows version of qFT8 also ships with its own Java Runtime Environment (JRE). Therefore, adding private CA certificates to the Windows certificate store does not necessarily make them available to qFT8.

The following procedure identifies the bundled Java runtime and imports the required CA certificates into its dedicated truststore.

Step 1: Find the qFT8 Java Runtime

Start the qFT8 Application and open PowerShell

⚠️ Important prerequisite: qFT8 must be running before executing the following PowerShell commands. The commands identify the Java process started by qFT8. If the application is not running, the required process information will not be available.

Run the following command to identify the Java process started by qFT8:

Get-CimInstance Win32_Process |
  Where-Object {
    $_.Name -match 'qft8|java|javaw'
  } |
  Select-Object Name, ProcessId, ParentProcessId, ExecutablePath, CommandLine |
  Format-List

Output:
Name            : qFT8.exe
ProcessId       : <PID>
ParentProcessId : <PARENT_PID>
ExecutablePath  : C:\Users\<USERNAME>\Desktop\qFT8\qFT8.exe
CommandLine     : "C:\Users\<USERNAME>\Desktop\qFT8\qFT8.exe"

Name            : javaw.exe
ProcessId       : <PID>
ParentProcessId : <QFT8_PID>
ExecutablePath  : C:\Users\<USERNAME>\AppData\Local\qFT8\program\qFT8\<VERSION>\jre\bin\javaw.exe
CommandLine     : "C:\Users\<USERNAME>\AppData\Local\qFT8\program\qFT8\<VERSION>\jre\bin\javaw.exe"
                  -XX:+AutoCreateSharedArchive -XX:SharedArchiveFile=qft8.jsa -XX:InitialRAMPercentage=0.5
                  -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=30 -XX:+ShrinkHeapInSteps
                  -XX:G1PeriodicGCInterval=15000 -XX:G1PeriodicGCSystemLoadThreshold=0
                  "-Djava.library.path=C:\Users\<USERNAME>\AppData\Local\qFT8\program\qFT8\<VERSION>"
                  -jar "C:\Users\<USERNAME>\AppData\Local\qFT8\program\qFT8\<VERSION>\qft8-desktop.jar"

Look for the javaw.exe process. Its executable path identifies the bundled Java runtime. The actual version directory may differ between installations.

Step 2: Locate the Java Truststore

Search for the cacerts file inside the qFT8 installation directory:

Get-ChildItem "$env:LOCALAPPDATA\qFT8" `
  -Filter cacerts -Recurse -File `
  -ErrorAction SilentlyContinue

The result should point to a location similar to:

C:\Users\<username>\AppData\Local\qFT8\program\qFT8\<version>\jre\lib\security\cacerts

Output:
>>   -Filter cacerts -Recurse -File `
>>   -ErrorAction SilentlyContinue

Verzeichnis: C:\Users\<USER>\AppData\Local\qFT8\program\qFT8\<HASH>\jre\lib\security

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        30.10.2026     10:02         153428 cacerts

This is the truststore used by the bundled Java runtime.

Step 3: Prepare the Java Environment

Close qFT8 completely.

Set the paths to the bundled JRE and its truststore. Replace <HASH> with the directory identified in the previous steps:

$QFT8_JRE = "C:\Users\<USER>\AppData\Local\qFT8\program\qFT8\<HASH>\jre"
$KEYTOOL = "$QFT8_JRE\bin\keytool.exe"
$TRUSTSTORE = "$QFT8_JRE\lib\security\cacerts"

Place your private CA certificates in a convenient directory, for example:

C:\Certificates\ExampleCorp Root-CA.crt
C:\Certificates\ExampleCorp Intermediate-CA.crt

Step 4: Back Up the Truststore

Before modifying the Java truststore, create a backup:

Copy-Item $TRUSTSTORE "$TRUSTSTORE.backup"

Step 5: Import the Root CA

Import the root CA certificate:

& $KEYTOOL -importcert `
  -alias examplecorp-root-ca `
  -file "C:\Certificates\ExampleCorp Root-CA.crt" `
  -keystore $TRUSTSTORE

Enter the truststore password when prompted. The default Java truststore password is usually changeit.

Confirm the certificate import by entering:

Trust this certificate? [No]:  yes
Certificate was added to the keystore

Step 6: Import the Intermediate CA

Import the intermediate CA certificate:

& $KEYTOOL -importcert `
  -alias examplecorp-intermediate-ca `
  -file "C:\Certificates\ExampleCorp Intermediate-CA.crt" `
  -keystore $TRUSTSTORE

Again, enter the truststore password and confirm the import with yes.

Step 7: Verify the Imported Certificates

Check that both CA certificates are present:

& $KEYTOOL -list `
  -keystore $TRUSTSTORE `
  -storepass changeit |
  Select-String "examplecorp"

The output should contain both entries:

examplecorp-root-ca
examplecorp-intermediate-ca

Step 8: Restart qFT8

Start qFT8 again and test the connection to your Wavelog instance.

The bundled Java runtime should now trust the private PKI and be able to establish the HTTPS connection.

Important: The qFT8 installation directory may change when the applicatio is updated. If a future update installs a new bundled JRE, the CA certificates may need to be imported into its truststore again.