TLS certificate error on WEB/Tracking connection

[RobertOl1]

Hey adobe campaign classic 7 wizards, i'm in bit of a bind here.

Suddenly we can't upload pictures to our tracking / web server.

we get this error 

IOB-090020 Error in SSL library: 'IOB-090013 error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (code 337047686)'
XSV-350059 Unable to upload the images to the tracking servers.

So it seems that TLS cert, is the problem.

It is build in amazon work spcaces.

We have a load balancer added, but i have checked the load balancer, the application server, the web/tracking server and the RDS database, and everyone seems to be with a valid TLS certificate

It worked fine in December.

Any clue to where to look next ? 

Many Thanks

Robert.

[RobertOl1]

i keep finding threads on OS / local SSL/tls certicate, but i can't find any documentation on how to update a ssl/tls certificate on a on-prem system windows on aws.

If anyone can help with that id would love to try to see if that fixes the issue.

[_Manoj_Kumar_]

Hello @RobertOl1  I have seen this issue on hosted environments as well. It happens when you trying to reupload the images using the URL of an already uploaded images.

The workaround for us was not to use the Adobe hosted URL to re-upload the images.

[RobertOl1]

Hi Kumar, thanks for the reply ! 

We are hosting our own web/tracking server on AWS as well and is trying to upload to that. 

So i am pretty sure Adobe Hosted URL isn't a part of the solution.

the URL for the web resources are our own domain.

Regards Robert.

[_Manoj_Kumar_]

Hello @RobertOl1  That was just an example.

It seems Adobe fails to verify the tls certificate when we try to upload the existing image using the same instance URL.

[RobertOl1]

Hi Kumar, it indeed seems that way... but we have looked at all certificates we can find, and they seem to be correct.

it still happens why trying new pictures as well. we tried the openSSL command:

https://experienceleague.adobe.com/en/docs/campaign-classic/using/installing-campaign-classic/securi...

 and as you can see it finds it, it does say unable to local verify.. but we get exact same error on preprod, and works there.

PS: This reply has been edited at the request of the author of this reply.

[_Manoj_Kumar_]

Hello @RobertOl1  Can you try by downloading the CA root certificate and try running the command like this:

openssl s_client -connect <server>:443 -CAfile <path_to_ca_bundle>

[RobertOl1]

Sorry how do i find this path_to_ca_bundle ? The guy who set this up isnt part of the organzation anymore unfortunately.

Regards Robert.

[RobertOl1]

Sorry misread, how do i download the CA root certificate, i have used the command openssl s_client -connect <server>:443 to see our amazon cert before. 

[RobertOl1 · Accepted solution]

visit the URL - https:///view/home and download the intermediate and root certificate. Once downloaded, please add both certificates to the trusted root folder on your local machine! This is a requirement in the latest builds of Adobe Campaign. Steps to Add Certificates to Trusted Root Certification Authorities: Adding Certificates to Trusted Root Certification Authorities 1. Download the Certificates: a) Ensure you have downloaded the intermediate and root certificate files to your computer (usually with a .crt or .cer extension). 2. Open the Run Dialog: a) Press Windows + R on your keyboard to open the Run dialog. 3. Open the Certificates Management Console: a) Type mmc and press Enter to open the Microsoft Management Console. 4. Add the Certificates Snap-In: a) In the MMC window, click on File in the top menu, then select Add/Remove Snap-in.... b) In the pop-up window, select Certificates from the list on the left and click Add >. c) Choose Computer account and click Next. Then select Local computer and click Finish. d) Click OK to close the snap-in selection window. 5. Navigate to Trusted Root Certification Authorities: a) In the left pane of the MMC, expand Certificates (Local Computer). b) Expand the Trusted Root Certification Authorities folder, then click on the Certificates subfolder. 6. Import the Certificates: a) Right-click on the Certificates subfolder under Trusted Root Certification Authorities, and then select All Tasks > Import.... b) In the Certificate Import Wizard, click Next. c) Click the Browse button and select the root certificate file you downloaded, then click Next. d) Ensure that Place all certificates in the following store is selected, and it should default to Trusted Root Certification Authorities. Click Next. e) Click Finish to complete the import process. You should see a message confirming that the import was successful. 7. Repeat for the Intermediate Certificate: a) Follow the same steps to import the intermediate certificate. Right-click on Certificates in the Intermediate Certification Authorities folder (or create this folder if necessary) and repeat the import steps. 8. Close the MMC: a) After adding both certificates, you can close the MMC. If prompted, you can choose not to save the console settings. 9. Restart Your Applications: a) Restart any applications that rely on these certificates to ensure they recognize the new trusted certificates.