U02000385 Web socket error: 'PKIX path building failed

[Marcos_Cristiano_Ickert_412]

Hello.

We are configuring a new agent SAP in version 21 and we try to start it, show this error in log:

20231218/164839.901 - U02000071 Current directory: /opt/Automic21/Automation.Platform/Agents/sap/bin
20231218/164839.901 - U02000066 Host information: Host name='nameofourserver', IP address='10.0.12.54'
20231218/164840.052 - U02000153 The JVM Option HeapDumpOnOutOfMemoryError is enabled.
20231218/164840.064 - U02000379 Initiating connection to server 'nameofourserver.weg.net:8443' using WebSocket URI: 'wss://nameofourserver.weg.net:8443/agent'.
20231218/164840.074 - Jetty: Logging initialized @668ms to com.uc4.ex.cp.JettyLogger
20231218/164840.077 - U02000378 Loading certificates from directory: '/opt/Automic21/Certificados/SAP'.
20231218/164840.106 - U02000377 Certificate loaded from file 'nameofourserver.cert'.
20231218/164840.608 - U02000385 Web socket error: 'PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target'.
20231218/164840.610 - javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.611 - Caused by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.612 - Caused by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.613 - java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.616 - Caused by javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.618 - Caused by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.620 - Caused by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
20231218/164840.621 - U02000380 Could not connect to server 'nameofourserver.weg.net:8443'.
20231218/164840.634 - U02000074 Connecting to system 'UC4' is not possible.
20231218/164840.634 - com.uc4.ex.cp.InitialConnectionException: Initial connection with endpoint not possible. Please check your configuration.
20231218/164840.635 - U02000041 Shutdown Agent 'XYZ'.
20231218/164840.636 - U02000002 Agent 'XYZ' version '21.0.8+build.1692622159974' ended abnormally.

Have you experts any idea how to solve this?

Thanks

Marcos.

[Peter Grundler]

Hi Marcos,

have already checked this page https://docs.automic.com/documentation/webhelp/english/ALL/components/DOCU/21.0.8/Automic%20Automation%20Guides/Content/_Common/Security/Security_TLS_Troubleshooting.htm?Highlight=tls%20trouble

regards,
Peter

------------------------------
Automic Certified Professional/Expert & Broadcom Knight

For AUTOMIC trainings please check https://www.qskills.de/qs/workshops/automic/
------------------------------

[Markus Embacher]

Hi Marcos,

to me it looks like you are using an unsupported JAVA version. Which one are you using?

Regards, Markus

[Marcos_Cristiano_Ickert_412]

Hello Markus.

This is the Java version:

java -version
openjdk version "11.0.21" 2023-10-17
OpenJDK Runtime Environment Temurin-11.0.21+9 (build 11.0.21+9)
OpenJDK 64-Bit Server VM Temurin-11.0.21+9 (build 11.0.21+9, mixed mode)

Marcos

[Andrzej Golaszewski]

Hi Marcos

the Java Version is OK, the decisive information is :

PKIX path building failed:unable to find valid certification path to requested target

This message means your Java can not handle the given certificate. I've seen this message many times in the beginning of implementing SSL in my Automic environment. 

• The CA is not in your truststore
  • Add the CA to your truststore
  • or if you use selfsigned certificates (not recommended) add the certificate to your java truststore
    
    
• The Certificate is invalid
  • Check the validity of your certificate

Before you start any automic component try to make a ssl Handshake with java. I prefer a little java program found some time ago called SSLPoke, easy to find via google search. Try this programm to check the certificates with the java version you use. 

Hope that helps!

Best regards

Andrzej Golaszewski

[Marcos_Cristiano_Ickert_412]

Hello to everybody.

Thanks for helping us with this issue.

We solved our problem following this link: Creating Certificates for JCP with Keystore Explorer for AWA v21

Broadcom		remove preview
Creating Certificates for JCP with Keystore Explorer for AWA v21 See below an example of the steps to perform all these steps with Keystore Explorer. When downloading the Keystore Explorer product for Windows, please make sure to select the installer that does not have the embedded Java: This is due to the version of the embedded Java not being compatible with Automic Automation. View this on Broadcom >

Marcos.