Connection failure with certificate issue due to empty TrustStore in RSA Governance & Lifecycle
Originally Published: 2024-07-16
Article Number
Applies To
RSA Version/Condition: 8.x
Issue
Caused by: com.aveksa.common.ConnectException: Connection failed at com.aveksa.common.http.client.RSAHTTPClient.execute(RSAHTTPClient.java:120) ~[common.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedDynamicAuthenticator.fetchToken(TokenBasedDynamicAuthenticator.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.AuthenticationManager.fetchToken(AuthenticationManager.java:44) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.getToken(TokenBasedAuthenticationManager.java:139) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.updateAuthenticationConfigurationInRequest(TokenBasedAuthenticationManager.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.GenericRESTClient.executeCollection(GenericRESTClient.java:217) ~[generic-rest-client.jar:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.collectAccountData(GenericRESTAccountDataIterator.java:158) ~[classes/:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.next(GenericRESTAccountDataIterator.java:68) ~[classes/:?] ... 13 more Caused by: javax.net.ssl.SSLHandshakeException: No X509TrustManager implementation available
Cause
The error is happening because java TrustStore found at ${JAVA_HOME}/jre/lib/security/cacerts file is found to be empty.
This indicates Java is unable to validate trusted certificates. The Java JDK could be installed incorrectly (likely installed with the wrong Unix account or wrong sudo command) and has replaced the current cacerts with an empty file and backed up the previous one:
Resolution
${JAVA_HOME}/jre/lib/security/cacerts file needs to be restored manually after the upgrade if this problem is encountered.
It can be restored from the backup "cacerts.1719000895 in the above screenshot" by copying it over the empty "cacerts".
It can also be restored/replaced from another environment (or from any other backup if available).
Related Articles
Fortigate SSL VPN Timeout Issue with Approve/Biometrics 142Number of Views Persistence layer issue in RSA Identity Governance & Lifecycle degrades performance and potentially leads to system crash 70Number of Views Troubleshooting AFX Server issues in RSA Identity Governance & Lifecycle 560Number of Views Error while importing RSA Identity Management and Governance Collector metadata: java.lang.IllegalStateException: An issue… 199Number of Views Incorrect setting for Oracle PARALLEL_DEGREE_POLICY causes issue in RSA Identity Governance & Lifecycle 80Number of Views
Trending Articles
How to Download OTP Token Seed Files from myRSA RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide RSA Authentication Manager 8.7 SP2 Setup and Configuration Guide RSA Authentication Manager 8.9 Release Notes (January 2026) RSA Release Notes for RSA Authentication Manager 8.8
Don't see what you're looking for?