I was setting up one dispatcher flush agent in one of my publisher server to implement a real scenario. After entering values in all the required fields, when I click on the Test Connection on the result page it says “Replication test failed“ After looking into the stack trace I was surprised and clueless as the required certificate was present and active on my dispatcher server. Stack trace: Error while sending request: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target After doing some google, I came to know that though you have certificate present there on your application server and not expired as well, java(JRE) installed, on which your AEM instance is running, is not recognising because those certificates were self signed. Now the question is, how to make java to trust the certificate? Lets find out the answer To make your Java Runtime Environment trust the certificate, you will have to import the certificate into the JRE certificate store. Steps to import the certificate to the JRE certificate Store: First, you need to download the certificate in your local machine after opening the site in any browser. Path for the certificate can be different in different browser. like in Chrome you can find it in, Chrome Customise →More Tools →Developer Tool →Security Tab → View Certificate button. Then drag the certificate in somewhere in your machine.
Please use this thread to ask the related questions.
Topics help categorize Community content and increase your ability to discover relevant content.
We are facing same exception while connecting to Service Layer APIs with domain for example services.companyname.com from AEM instance.
Do we need to add the certificate in AEM Global Trust Store?
Adding certificate to AEM Global Trust Store and adding on the server, on which AEM and Java are installed, how are these both different?
Below is the exception stack trace
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:259) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:642) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:461) at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:361) at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
Hi @srikanthpogula ,
The issue, you mentioned, is the same issue explained in the blog.
Let me make it clear once more, the problem was associated with the JRE not directly with AEM so you need to provide a fix for the JRE, on which you AEM instance is running.
In the case of handshake your JRE is not recognising the target instance certificate and so it is throwing the exception.
Once you make your JRE recognise the certificate of the target server your issue will resolve.
Please follow the steps given in the blog.
Hope this helps
Hi @Umesh_Thakur ,
Thanks for the response.
I did follow the blog and add the certificate to JDK (not JRE) cacerts file on the server where AEM is installed but the issue still exists.
I could not find JRE path on the server (it is an AMS maintained AEM instance). I found the java/JDK path with the help of command whereis java. Could this be an issue that I added certificate to JDK instead of JRE?
If you have JDK, then definitely you will have jre as well, please try to locate. path will be like /app/temp/jdk/jdk1.8.0_191/jre/lib/security/cacerts
Since this is an Adobe Managed instance, I would recommend you to raise this concern with the adobe support to fix the issue as a whole if not then at least they will help you to locate JRE.
Hope this will be helpful to you.
Below is the only place on AMS publish instance where I could see JRE /usr/java/jdk1.8.0_251-amd64/jre/lib/security/cacerts.
I imported the cert by running the keytool import command and did an AEM instance restart but still see the same issue.
Is server reboot required after adding the certificate to JRE cacerts?
This is the java version output
java version "11.0.5" 2019-10-15 LTS
Java(TM) SE Runtime Environment 18.9 (build 11.0.5+10-LTS)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.5+10-LTS, mixed mode)