'javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path' error when testing a RESTful Web Service AFX Connector in RSA Identity Governance & Lifecycle
Originally Published: 2020-04-10
Last Modified: 2023-10-06
Article Number
000049780
Applies To
RSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition: 7.0.x, 7.1.x, 7.2.x
 
Issue
After creating a RESTful web service AFX connector, the connector shows with a Running status but a test of the connector fails with:
 
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path.
 
  • Connector in a Running state:
 
User-added image
 
  • Output from a test of the connector:
 
User-added image
 
  • Accessing the same URL via a REST/SOAP tool has no issues:
 
User-added image

 
Cause
The SSL certificate for the REST API URL being accessed is not trusted in the RSA Identity Governance & Lifecycle truststore.
 
Resolution
Download the SSL certificate used by the URL being accessed and load it into the truststore. The example below shows how to obtain the certificate using Firefox and add the certificate to the truststore.
  1. Launch Firefox.
  2. Open the URL being accessed by the AFX RESTful web service connector.
  3. In the left-hand corner, click on the lock icon or the Info button to see the certificate issuer.
  4. Click the > at the right for more details.
  5. Click the More Information button.
  6. Click View Certificate.  
  User-added image
  1. Scroll down until you see the Download option:
PEM (cert) PEM (chain) 
  1. Click on PEM (cert) to download the certificate in PEM format.
  2. Import the certificate to the JVM cacert as the root user:
keytool -importcert -alias startssl -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit 
-file <path to the cert saved in step 7a>
  1. After importing the certificate, restart the AFX server as the afx user:
afx stop
afx start

 

Related Articles

Trending Articles

Don't see what you're looking for?