Connection failure with certificate issue due to empty TrustStore in RSA Governance & Lifecycle
Originally Published: 2024-07-16
Article Number
Applies To
RSA Version/Condition: 8.x
Issue
Caused by: com.aveksa.common.ConnectException: Connection failed at com.aveksa.common.http.client.RSAHTTPClient.execute(RSAHTTPClient.java:120) ~[common.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedDynamicAuthenticator.fetchToken(TokenBasedDynamicAuthenticator.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.AuthenticationManager.fetchToken(AuthenticationManager.java:44) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.getToken(TokenBasedAuthenticationManager.java:139) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.updateAuthenticationConfigurationInRequest(TokenBasedAuthenticationManager.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.GenericRESTClient.executeCollection(GenericRESTClient.java:217) ~[generic-rest-client.jar:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.collectAccountData(GenericRESTAccountDataIterator.java:158) ~[classes/:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.next(GenericRESTAccountDataIterator.java:68) ~[classes/:?] ... 13 more Caused by: javax.net.ssl.SSLHandshakeException: No X509TrustManager implementation available
Cause
The error is happening because java TrustStore found at ${JAVA_HOME}/jre/lib/security/cacerts file is found to be empty.
This indicates Java is unable to validate trusted certificates. The Java JDK could be installed incorrectly (likely installed with the wrong Unix account or wrong sudo command) and has replaced the current cacerts with an empty file and backed up the previous one:
Resolution
${JAVA_HOME}/jre/lib/security/cacerts file needs to be restored manually after the upgrade if this problem is encountered.
It can be restored from the backup "cacerts.1719000895 in the above screenshot" by copying it over the empty "cacerts".
It can also be restored/replaced from another environment (or from any other backup if available).
Related Articles
Fortigate SSL VPN Timeout Issue with Approve/Biometrics 139Number of Views RSA Authentication Manager 8.7 SP1 upgrade fails due to GRUB issue 144Number of Views Error while importing RSA Identity Management and Governance Collector metadata: java.lang.IllegalStateException: An issue… 195Number of Views Urgent Notice: Issue with Embedded IDR Image Downloads 192Number of Views AFX Server remains in a 'Not running' State with 'An issue with handling encryption was encountered' error on startup in R… 489Number of Views
Trending Articles
Troubleshooting RSA SecurID Access Identity Router to RSA Authentication Manager test connection failures RSA SecurID Software Token 5.0.2 Downloads for Microsoft Windows RSA Authentication Manager 8.9 Release Notes (January 2026) Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory RSA Authentication Manager 8.8 Setup and Configuration Guide
Don't see what you're looking for?