Forum Discussion

davea's avatar
davea
Occasional Contributor
9 years ago

how to debug cert error in ccollab cli on win7

We just upgraded from 8.4 to 9.5.9501.  We have one user that is getting this error when trying ccollab login from a cmd box:       PKIX path building failed... unable to find valid certification...
  • davea's avatar
    davea
    9 years ago

    OK, it turns out its a Java configuration problem.  The way I was trying to add the CA cert or server cert was either wrong or doesn't work anymore.  I did add our CA cert to the system certs in java's lib/security/cacerts file using keytool and now it works.

     

    In the past, with this error, it would prompt if we wanted to permanantly accept the servers cert.  That prompt no longer occurs.  I don't know if that is because it's a different Java version, or Java settings, or if that was something in the ccollab client code

     

     

davea's avatar
davea
Occasional Contributor
9 years ago

OK, I just found the --debug option.  I also discovered that it was working for me because I still had client 8.4.8406 installed on my machine.  When I upgraded my client to 9.5.9501, I also get the certificate error. So two machines that have upgraded the client to 9.5 are getting this error.

 

I am looking at the debug log now.  For security reasons, I am not able to transfer it off the project network. 

 

  • davea's avatar
    davea
    Occasional Contributor
    9 years ago

    So I decided to try the GUI client on windows, and if I go into Preferences and try Test Connection, I get basically the same error. 

     

    Looking at the collab.log file, when starting the connection, there's some lines about header lines being added, then one with a command of SessionService.authenticate.  Then Closing the connection, then the exception:

     

    javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:   ... and so on.

     

     

    • davea's avatar
      davea
      Occasional Contributor
      9 years ago

      OK, it turns out its a Java configuration problem.  The way I was trying to add the CA cert or server cert was either wrong or doesn't work anymore.  I did add our CA cert to the system certs in java's lib/security/cacerts file using keytool and now it works.

       

      In the past, with this error, it would prompt if we wanted to permanantly accept the servers cert.  That prompt no longer occurs.  I don't know if that is because it's a different Java version, or Java settings, or if that was something in the ccollab client code