Connection failure with certificate issue due to empty TrustStore in RSA Governance & Lifecycle
Originally Published: 2024-07-16
Last Modified: 2025-01-27
Article Number
Applies To
RSA Version/Condition: 8.x
Issue
Caused by: com.aveksa.common.ConnectException: Connection failed at com.aveksa.common.http.client.RSAHTTPClient.execute(RSAHTTPClient.java:120) ~[common.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedDynamicAuthenticator.fetchToken(TokenBasedDynamicAuthenticator.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.AuthenticationManager.fetchToken(AuthenticationManager.java:44) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.getToken(TokenBasedAuthenticationManager.java:139) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.authenticationManager.TokenBasedAuthenticationManager.updateAuthenticationConfigurationInRequest(TokenBasedAuthenticationManager.java:63) ~[generic-rest-client.jar:?] at com.aveksa.client.genericrest.GenericRESTClient.executeCollection(GenericRESTClient.java:217) ~[generic-rest-client.jar:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.collectAccountData(GenericRESTAccountDataIterator.java:158) ~[classes/:?] at com.aveksa.collector.generic.rest.adc.GenericRESTAccountDataIterator.next(GenericRESTAccountDataIterator.java:68) ~[classes/:?] ... 13 more Caused by: javax.net.ssl.SSLHandshakeException: No X509TrustManager implementation available
Cause
The error is happening because java TrustStore found at ${JAVA_HOME}/jre/lib/security/cacerts file is found to be empty.
This indicates Java is unable to validate trusted certificates. The Java JDK could be installed incorrectly (likely installed with the wrong Unix account or wrong sudo command) and has replaced the current cacerts with an empty file and backed up the previous one:
Resolution
${JAVA_HOME}/jre/lib/security/cacerts file needs to be restored manually after the upgrade if this problem is encountered.
It can be restored from the backup "cacerts.1719000895 in the above screenshot" by copying it over the empty "cacerts".
It can also be restored/replaced from another environment (or from any other backup if available).
Related Articles
RSA Authentication Manager 8.7 SP2 Security Configuration Guide 323Number of Views RSA Authentication Manager 8.7 SP2 Patch 4 Web Tier Readme 29Number of Views BIOS hardening for RSA Authentication Manager 8.x 330Number of Views Error while importing RSA Identity Management and Governance Collector metadata: java.lang.IllegalStateException: An issue… 203Number of Views Quick Setup Guide - Passwordless Authentication for RSA ID Plus 14Number of Views
Trending Articles
Report preview and/or generation fails with 'java.lang.NoClassDefFoundError: Could not initialize class net.sf.jasperrepor… How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device How to set up the REST RSA SecurID Authentication API for Authentication Manager 8.2 SP1 RSA Authentication Manager 8.9 Patches and Hotfixes Readme RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide
Don't see what you're looking for?