Forum Discussion

davea's avatar
davea
Occasional Contributor
9 years ago

how to debug cert error in ccollab cli on win7

We just upgraded from 8.4 to 9.5.9501.  We have one user that is getting this error when trying ccollab login from a cmd box:       PKIX path building failed... unable to find valid certification...
  • davea's avatar
    davea
    9 years ago

    OK, it turns out its a Java configuration problem.  The way I was trying to add the CA cert or server cert was either wrong or doesn't work anymore.  I did add our CA cert to the system certs in java's lib/security/cacerts file using keytool and now it works.

     

    In the past, with this error, it would prompt if we wanted to permanantly accept the servers cert.  That prompt no longer occurs.  I don't know if that is because it's a different Java version, or Java settings, or if that was something in the ccollab client code

     

     

davea's avatar
davea
Occasional Contributor

So I decided to try the GUI client on windows, and if I go into Preferences and try Test Connection, I get basically the same error. 

 

Looking at the collab.log file, when starting the connection, there's some lines about header lines being added, then one with a command of SessionService.authenticate.  Then Closing the connection, then the exception:

 

javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:   ... and so on.

 

 

davea's avatar
davea
Occasional Contributor
9 years ago

OK, it turns out its a Java configuration problem.  The way I was trying to add the CA cert or server cert was either wrong or doesn't work anymore.  I did add our CA cert to the system certs in java's lib/security/cacerts file using keytool and now it works.

 

In the past, with this error, it would prompt if we wanted to permanantly accept the servers cert.  That prompt no longer occurs.  I don't know if that is because it's a different Java version, or Java settings, or if that was something in the ccollab client code