Downloading the RSA SecurID Access Embedded Identity Router fails on Authentication Manager 8.5

[#1]

Article Number

000039546

Applies To

RSA Product Set: SecurID Access
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.5

Issue

Attempting to install and configure the embedded identity router on Authentication Manager 8.5 fails on the Downloading identity router image step:

Image description


The imsTrace.log from Authentication Manager shows errors with connecting to the Cloud Authentication Service due to a certificate issue: 
 

com.rsa.internal.admin.casapimgmt.CASConnectionManagerException: Authentication Manager cannot connect to Cloud Authentication Service. Connection failed.
	at com.rsa.authmgr.internal.idr.impl.CASAPIConnectionImpl.createConnectionRequest(CASAPIConnectionImpl.java:379)
	at com.rsa.authmgr.internal.idr.impl.CASAPIConnectionImpl.processRequest(CASAPIConnectionImpl.java:271)
	at com.rsa.authmgr.internal.idr.impl.task.IdentityRouterDowloadImageTask.execute(IdentityRouterDowloadImageTask.java:108)
	at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.doExecuteTask(TaskGroupExecutor.java:105)
	at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.executeTasks(TaskGroupExecutor.java:60)
	at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.run(TaskGroupExecutor.java:47)
Caused by: javax.net.ssl.SSLException: Certificate not verified.
...
Caused by: com.rsa.sslj.x.aL: Certificate not verified.
	at com.rsa.sslj.x.bm.a(Unknown Source)
	at com.rsa.sslj.x.bm.a(Unknown Source)
	at com.rsa.sslj.x.bm.a(Unknown Source)
...
Caused by: java.security.cert.CertificateException: the certificate chain is not trusted, Could not validate path.
	at com.rsa.sslj.x.cq.a(Unknown Source)
	at com.rsa.sslj.x.cq.checkServerTrusted(Unknown Source)
	at com.rsa.sslj.x.cq.b(Unknown Source)
	at com.rsa.sslj.x.aF.a(Unknown Source)

 

Cause

Authentication Manager 8.5 cannot successfully communicate with the download source of the embedded identity router due to certificate changes made on the download source.

Resolution

Update Authentication Manager to 8.5 Patch 1 or above. Changes were made in Authentication Manager 8.5 Patch 1 and above to account for the certificate changes made on the download source of the embedded identity router.