Article created with
FME Server 2015.0
Symptom
Errors similar to those below are found in various FME Server or Tomcat log files.javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(Unknown Source) at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) at sun.security.validator.Validator.validate(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:unable to find valid certification path to requested target
Caused by: sun.security.validator.ValidatorException: PKIX path building failed:sun.security.provider.certpath.SunCertPathBuilderException: unable to findvalid certification path to requested target
Caused by: sun.security.provider.certpath.SunCertPathBuilderException:unable to find valid certification path to requested target
Cause
The certificate used for SSL has not been imported into the FME Server cacerts truststore or is a self-signed certificate.
Resolution
Obtain a copy of the CER file and import it into the FME Server cacerts truststore.
- Login to FME Server using a web browser (e.g. Google Chrome)
- View the “Certificate Information”
- Select “Copy to File…”
- Save as a “Base-64 encoded X.509 (CER)” to local disk (e.g. <certpath>\mycert.cer)
- Using the Command Window (as an Administrator), set the directory set <FMEServer>\Utilities\jre\bin
- Enter the following command, making the appropriate changes to <FMEServer> and <certpath>:
keytool -import -trustcacerts -keystore <FMEServer>\Utilities\jre\lib\security\cacerts -storepass changeit -noprompt -alias mycert -file <certpath>\mycert.cer
You may also see errors similar this when configuring Active Directory with SSL encryption.
Exception: "An error occurred while attempting to send the LDAP message to server its-ad-ldap.it.com:636: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
Exception: "An error occurred while attempting to send the LDAP message to server its-ad-ldap.it.com:636: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target caused by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
keytool -import ... is now keytool -importcerts this will affect newer versions of Java.
I do not know whether the command has changed again but yesterday I had to use keytool -importcert (without an 's' at the end)
Hi @conterramarcel, what version of Java were you using? That information might be helpful to note for others. I'm sorry about the inconvenience here!
