CAST AIP - SSL - Errors - PXIX path building failed - How to import certificate into JRE/JDK

The error stack is shown below - 

javax.net.ssl.SSLHandshakeException:sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1570)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1498)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352)

To find the  AIP Console and DMT Logs please refer CAST Management Studio - Information - How to find logs 

Observed in RDBMS

RDBMS	Yes/No
CSS

1. Encountered error in log.

The issue occurs because the certificate of the site is not imported into the JRE/JDK used. 

1. To import the certificate, please follow the below steps -

              a. In the Browser URL for CAST Extend or HTTPS Maven repository – Click on the lock symbol to view the drop-down menu like below and click on Certificate.

             b. The Certificate window opens. Now click on Details Tab and perform the Copy to File click 

             c. The certificate wizard opens - 

            d. While exporting select the first option.​

         e. Provide a file path with file name and save with the extension type .CER 

            f. Click on Finish. 

        g. To import the certificate into your JRE/JDK  - be careful if you have mutiple Java installations that you are importing the certificate into the proper keystore.

                    From an admin Command prompt, run the below command –

On Windows: <JRE home>\bin\keytool -importcert -trustcacerts -file <certificate file> -keystore <JRE_JDK home>\lib\security\cacerts -storepass <password>

On Linux: <JRE home>/bin/keytool -importcert -trustcacerts -file <certificate file> -keystore <JRE_JDK home>/lib/security/cacerts -storepass <password>
<...> placeholders must be replaced with appropriate values:
<certificate file>: the path to the file containing the CER-encoded certificate
<JRE_JDK home>: the path to the JRE_JDK on the delivery machine
<password>: the password for the JRE/JDK's CA certs key store

2. Restart the AIP service associated with the keystore (Imaging, Node and Console, etc.)

If the above steps do not solve your issue contact CAST Technical Support. with the below Relevant input

Relevant input

• Log file showing the error
• A detailed list of the steps done
• Screenshots from part of AIP showing the issue 

Ticket # 28606