Unable to Connect to SSL Services due to PKIX Path Building Failed

Symptom: Connection is refused when attempted to access applications that are encrypted with SSL.

Error: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Diagnosis: Use SSLPoke to verify the connectivity (you will have to download SSLPoke.class using the following link: https://confluence.atlassian.com/kb/files/779355358/779355357/1/1441897666313/SSLPoke.class)

# /apps/java/latest/bin/java -classpath /apps/java/latest SSLPoke <hostname> <Port>

# /apps/java/latest/bin/java -classpath /apps/java/latest -Djavax.net.ssl.trustStore=/apps/java/latest/lib/security/cacerts SSLPoke <hostname> <Port>

# curl -X POST -d @Test.xml https://<endpoint url> -H "Content-Type:application/xml"

**add some xml code in Test.xml

If the above command is showing "Successfully connected" or downloaded the Test.xml, the SSL connection is fine.

If the above command fails (confirming the problem that the truststore doesn't contain the appropriate certificates), then the certificate will need to be imported into that truststore.

You can check the certificate availability, using the following commands:

# /apps/java/latest/bin/keytool -list -v -keystore /apps/java/latest/lib/security/cacerts

# /apps/java/latest/bin/keytool -list -v -keystore /apps/java/latest/lib/security/cacerts -alias <host_alias>

Comments

  1. Anonymous11/28/2016 7:46 am

    Hii, I just discovered your website gent00.com
    it is kind of abandoned, why don't you use it?

    ReplyDelete
  2. Abid Bhatti12/19/2016 8:44 pm

    Nice informative blog. You have really useful stuff. Thanks for sharing.
    How To Change Direct Admin’s Default Port Number?

    Regards
    Abid Bhatti

    ReplyDelete

Post a Comment

Popular posts from this blog

SVN: File remains in conflict

This error occurs when you didn't update the SVN and try to commit changes or, someone has made changes to this file that are conflicting with your changes. There are two ways to handle this situation. Either, you can revert back the changes you want to commit and then, update the SVN and after that make the changes again and commit. The other way is, you need to resolve the conflicted files one by one. You can keep all the conflicted files in a folder and resolved it at once. >> Revert the changes steps: svn revert . -R svn up >> Resolve the conflicted files: svn resolved <file_name>
Read more

12 tweakings for WHM/cPanel to speed up WordPress

   1. Turning Mailman off – WHM >> Server Configuration >>  Tweak Settings and turning it off    2. Number of minutes between mail server queue runs (default is 60) – Setting it 120    3. Default catch-all/default address behavior for new accounts” to fail    4. Boxtrapper Spam Trap and SpamAssassin Spam Box delivery – off    5. Analog Stats – off    6. Conserve Memory at the expense of using more cpu/diskio – turn on    7. WHM >> Service Configuration >> FTP Server Configuration – Check ‘no’ to ‘allow anonymous logins and ‘no’ to ‘anonymous uploads’    8. WHM >> cPanel >> Manage Plugins – install spamdconf – then go to ‘Setup Spamd Startup Configuration’ – select option 2 ‘Maximum Children” to 2′    9. Run your cron jobs at off peak hours.   10. Install e Accelerator PHP accelerator (Recompile Apache with eAccelerator)   11. ...
Read more

HowTo: Enable extended logging for exim

When troubleshooting mail or attempting to discover the source of spam originating from your server, it is often useful to enable extended Exim logging. You can enable extended logging for exim though your shell prompt as well as through WHM interface. I am giving the steps for both ways one by one: 1. Through shell prompt: 1. Open exim.conf 2) Find this: hostlist auth_relay_hosts = * 3) After hostlist auth_relay_hosts = * add the following: log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn 4) The final result should look like this hostlist auth_relay_hosts = * log_selector = +address_rewrite +all_parents +arguments +connecti...
Read more