Article Number
000039546
Applies To
RSA Product Set: SecurID Access
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.5
Issue
Attempting to install and configure the embedded identity router on Authentication Manager 8.5 fails on the
Downloading identity router image step:
Image descriptionThe imsTrace.log from Authentication Manager shows errors with connecting to the Cloud Authentication Service due to a certificate issue:
com.rsa.internal.admin.casapimgmt.CASConnectionManagerException: Authentication Manager cannot connect to Cloud Authentication Service. Connection failed.
at com.rsa.authmgr.internal.idr.impl.CASAPIConnectionImpl.createConnectionRequest(CASAPIConnectionImpl.java:379)
at com.rsa.authmgr.internal.idr.impl.CASAPIConnectionImpl.processRequest(CASAPIConnectionImpl.java:271)
at com.rsa.authmgr.internal.idr.impl.task.IdentityRouterDowloadImageTask.execute(IdentityRouterDowloadImageTask.java:108)
at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.doExecuteTask(TaskGroupExecutor.java:105)
at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.executeTasks(TaskGroupExecutor.java:60)
at com.rsa.authmgr.internal.common.taskgroupmanager.util.TaskGroupExecutor.run(TaskGroupExecutor.java:47)
Caused by: javax.net.ssl.SSLException: Certificate not verified.
...
Caused by: com.rsa.sslj.x.aL: Certificate not verified.
at com.rsa.sslj.x.bm.a(Unknown Source)
at com.rsa.sslj.x.bm.a(Unknown Source)
at com.rsa.sslj.x.bm.a(Unknown Source)
...
Caused by: java.security.cert.CertificateException: the certificate chain is not trusted, Could not validate path.
at com.rsa.sslj.x.cq.a(Unknown Source)
at com.rsa.sslj.x.cq.checkServerTrusted(Unknown Source)
at com.rsa.sslj.x.cq.b(Unknown Source)
at com.rsa.sslj.x.aF.a(Unknown Source)
Cause
Authentication Manager 8.5 cannot successfully communicate with the download source of the embedded identity router due to certificate changes made on the download source.
Resolution
Update Authentication Manager to 8.5 Patch 1 or above. Changes were made in Authentication Manager 8.5 Patch 1 and above to account for the certificate changes made on the download source of the embedded identity router.