000038716 - 'javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path' error when testing a RESTful Web Service AFX Connector in RSA Identity Governance & Lifecycle

Document created by RSA Customer Support Employee on Apr 10, 2020Last modified by RSA Customer Support Employee on Apr 13, 2020
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000038716
Applies ToRSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x, 7.2.x
IssueAfter creating a RESTful web service AFX connector, the connector shows with a Running status but a test of the connector fails with:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path.

  • Connector in a Running state:

User-added image

  • Output from a test of the connector:

User-added image


  • Accessing the same URL via a REST/SOAP tool has no issues:

User-added image

CauseThe SSL certificate for the REST API URL being accessed is not trusted in the RSA Identity Governance & Lifecycle truststore.
ResolutionDownload the SSL certificate used by the URL being accessed and load it into the truststore. The example below shows how to obtain the certificate using Firefox and add the certificate to the truststore.
  1. Launch Firefox.
  2. Open the URL being accessed by the AFX RESTful web service connector.
  3. In the left-hand corner, click on the lock icon or the Info button to see the certificate issuer.
  4. Click the > at the right for more details.
  5. Click the More Information button.
  6. Click View Certificate.  

  User-added image

  1. Scroll down until you see the Download option:

PEM (cert) PEM (chain) 

  1. Click on PEM (cert) to download the certificate in PEM format.
  2. Import the certificate to the JVM cacert as the root user:

keytool -importcert -alias startssl -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
-file <path to the cert saved in step 7a>

  1. After importing the certificate, restart the AFX server as the afx user:

afx stop
afx start