AnsweredAssumed Answered

AFX server not starting

Question asked by Pankaj Dabral on Sep 29, 2016
Latest reply on Sep 18, 2020 by Ian Staines

Like • Show 0 Likes0
Comment • 6

Hi. I am using 7.0 version and currently have Patch 2 installed.

After installing 7.0 version, I noticed that AFX folder was missing from /home/oracle location so I installed AFX using installAFX.sh -q and it got installed successfully.

But I see that AFX server is not running. I tried restarting the same but getting below error:

09/28/2016 23:59:47.463 ERROR (default task-14) [com.aveksa.afx.filters.AFXAuthFilter] Failed to authenticate AFX server due to certificate validation error.
com.aveksa.server.certificates.CertificateValidationException: java.lang.IllegalStateException: Client certificate serial number does not match expected value
        at com.aveksa.server.certificates.CertificateServiceProvider.validateClientCertificate(CertificateServiceProvider.java:350)
        at com.aveksa.afx.filters.AFXAuthFilter.authenticateAfxServer(AFXAuthFilter.java:109)
        at com.aveksa.afx.filters.AFXAuthFilter.doFilter(AFXAuthFilter.java:40)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
        at com.aveksa.gui.core.filters.LoginFilter.doFilter(LoginFilter.java:61)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)

Could anyone help me please? How to fix this issue?

Regards,

Pankaj

Andrew Ulliani

Sep 29, 2016 10:42 AM

Correct Answer

Looks like a problem with the SSL certificate in AFX. Try updating it using these steps from the doc:

Procedure

Click the AFX menu and select Servers.
Select the server for which you want to update the SSL certificate.
Click Change Certificate.
Click OK in the Change Certificate window.
Click Download Keystore and save the client.keystore file on your computer.
Copy the client.keystore file to <AFX-home>/mule/conf
Restart AFX.

See the reply in context

No one else had this question

Outcomes

Daniel Cinnamon

Sep 29, 2016 10:35 AM

When AFX calls back to the main server (over https), there is mutual SSL authentication going on, and in this case the server is rejecting the certificate that the AFX server is presenting.

Given that you just did an upgrade (presumably from a version prior to 7.x). I would do the following:

1) Stop AFX

2) In the UI- in AFX/servers, I would re-download the AFX server archive. This will give you an AFX_server.zip file.

2) Rename your existing AFX folder (assuming it's an appliance- /home/oracle/AFX) to AFX_Backup.

3) Unzip this zip file in it's place (it will recreate a new AFX folder).

4) start AFX again.

This will essentially make sure you're actually running the AFX server that the primary G&L server expects you to be running.

Actions

Andrew Ulliani

Sep 29, 2016 10:42 AM

Looks like a problem with the SSL certificate in AFX. Try updating it using these steps from the doc:

Procedure

Click the AFX menu and select Servers.
Select the server for which you want to update the SSL certificate.
Click Change Certificate.
Click OK in the Change Certificate window.
Click Download Keystore and save the client.keystore file on your computer.
Copy the client.keystore file to <AFX-home>/mule/conf
Restart AFX.

Actions

Daniel Cinnamon

@ Andrew Ulliani on Sep 29, 2016 11:01 AM

Just to explain the difference in responses- both Andrew and I's response will end up accomplishing the same thing. Andrew's method is more targeted, and will replace only the SSL certificates in the AFX server, whereas my method replaces the AFX server entirely (including the new SSL certs in it).

2 people found this helpful

Actions

Pankaj Dabral @ Daniel Cinnamon on Sep 29, 2016 2:05 PM

Thanks Dan for your help. The issue is resolved with your suggested steps.

Actions

Pankaj Dabral @ Andrew Ulliani on Sep 29, 2016 2:05 PM

Thanks Andrew. Your steps resolved the issue.

Actions

Ian Staines

@ Pankaj Dabral on Sep 18, 2020 2:38 PM

This post refers to older issues on older versions. Please refer to our Knowledge Base for current guidance on resolving AFX issues.
000038029 - Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle

Actions

6 Replies

Daniel Cinnamon Sep 29, 2016 10:35 AM
Mark Correct
Correct Answer
When AFX calls back to the main server (over https), there is mutual SSL authentication going on, and in this case the server is rejecting the certificate that the AFX server is presenting.

Given that you just did an upgrade (presumably from a version prior to 7.x). I would do the following:

1) Stop AFX
2) In the UI- in AFX/servers, I would re-download the AFX server archive. This will give you an AFX_server.zip file.
2) Rename your existing AFX folder (assuming it's an appliance- /home/oracle/AFX) to AFX_Backup.
3) Unzip this zip file in it's place (it will recreate a new AFX folder).
4) start AFX again.

This will essentially make sure you're actually running the AFX server that the primary G&L server expects you to be running.
Like • Show 4 Likes4
Actions
Andrew Ulliani Sep 29, 2016 10:42 AM
Unmark Correct
Correct Answer
Looks like a problem with the SSL certificate in AFX. Try updating it using these steps from the doc:

Procedure
1. Click the AFX menu and select Servers.
2. Select the server for which you want to update the SSL certificate.
3. Click Change Certificate.
4. Click OK in the Change Certificate window.
5. Click Download Keystore and save the client.keystore file on your computer.
6. Copy the client.keystore file to <AFX-home>/mule/conf
7. Restart AFX.
Like • Show 2 Likes2
Actions
- Daniel Cinnamon @ Andrew Ulliani on Sep 29, 2016 11:01 AM
  Mark Correct
  Correct Answer
  Just to explain the difference in responses- both Andrew and I's response will end up accomplishing the same thing. Andrew's method is more targeted, and will replace only the SSL certificates in the AFX server, whereas my method replaces the AFX server entirely (including the new SSL certs in it).
  2 people found this helpful
  Like • Show 1 Like1
  Actions
  - Pankaj Dabral @ Daniel Cinnamon on Sep 29, 2016 2:05 PM
    Mark Correct
    Correct Answer
    Thanks Dan for your help. The issue is resolved with your suggested steps.
    Like • Show 0 Likes0
    Actions
- Pankaj Dabral @ Andrew Ulliani on Sep 29, 2016 2:05 PM
  Mark Correct
  Correct Answer
  Thanks Andrew. Your steps resolved the issue.
  Like • Show 0 Likes0
  Actions
  - Ian Staines @ Pankaj Dabral on Sep 18, 2020 2:38 PM
    Mark Correct
    Correct Answer
    This post refers to older issues on older versions. Please refer to our Knowledge Base for current guidance on resolving AFX issues.
    000038029 - Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle
    Like • Show 0 Likes0
    Actions

AFX server not starting

Outcomes

Related Content

Recommended Content