TimWillemstein2 (Customer) asked a question.

April 18, 2024 at 8:29 AM
Could not build a validated path (AFX REST Connector)

Hi All,

 

I'm currently setting up a REST Connector ( in version 7.5.2. P07) but I'm facing some issue's with the PKIX building path.

Strange thing is that I have loaded the certificates from my target server in my AFX keystore (client.keystore). But i keep getting these errors:

imageimage.pngI have the exact same certificates loaded in my remote agent keystore and there they are working without any issue's.

 

Procedures I followed for AFX keystore changes:

Uploaded full chain of certificates via the Admin > User Interface > Files > SSL Certificates

Downloaded new AFX Server Archive > deployed on target server and started successfully.

I checked the keystore under esb/conf/client.keystore and the certificates are listed there.

 

But after testing the connector we get the exact same error as before. Did I miss any steps?

 

 

 

  • 11 answers
  • 326 views

  • Staines_ian (RSA Security)

    I have to suspect there is a defect in the way we are validating the multiple truststores use for certificate validation.

     

    My only suggestion is to manually add all the certificates directly to the main java cacerts keystore on the filesystem.

    Selected as Best

  • Staines_ian (RSA Security)

    I am not 100% confident what the status is on 7.5.2 version. I see an old defect from a year ago against 7.5.2 version saying this was a defect fixed in 8.0.0 version but the case also indicated the customer resolved it on 7.5.2 version by trusting all the certificates in the certificate chain in the GUI. Did you upload each the certificates in the CA chain separately as .cer files?

    • TimWillemstein2 (Customer)

      Yes indeed I have the full chain loaded (root, intermediate and server each as a separate certificate)

  • Staines_ian (RSA Security)

    Are your remote Aveksa Agent and your Remote AFX server on the same machine (using the same version of Java?)

  • Staines_ian (RSA Security)

    I have to suspect there is a defect in the way we are validating the multiple truststores use for certificate validation.

     

    My only suggestion is to manually add all the certificates directly to the main java cacerts keystore on the filesystem.

    Selected as Best
10 of 11

Don't see what you're looking for?