LAE

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: khopkins

Hello,

Whilst upgrading from version 4.5.3 and 4.6.1 to 6.1.3 enterprise server i have come across a new error which seems to be related to cetificates.

The JDBC nodes work quite happily whilst connecting to DISE/CMP DB2 data base with the old versions but now when testing the new ones they fail with the below error.

ERROR: unable to connect: The application requester cannot establish the connection. (sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderE xception: unable to find valid certification path to requested target)

Does anyone have any pointers please as this is running on a linux red hat server?

Regards,

Keith

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: khopkins

Hello,

I really need an answer to this as it is holding up the upgrade as we cannot retrieve data from this system.
I have added the certificates into the java keystore but the error is still occuring.

Any help would be greatly appreciated

Kind Regards,

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: gmullin

What is your JAVA_HOME variable? 6.1.3 will come with Java, whereas 4.x did not. I wonder is it referencing an different Java home directory. For 6.1.3 your JAVA_HOME should be <LAE_Install_Dir>/jre. The cacerts file LAE uses should be located in <JAVA_HOME>/jre/lib/security. I found an old issue where somebody encountered the same error on 4.x. Note that this is with Java as not part of the LAE installation.


JDBC Encryption Error "unable to find valid certification path to requested target"

The issue occurs when a SUN JRE and SUN JDK package are both installed. When you use the keytools command, it may add the keys into the Sun JRE CACERTS Key Store (not the JDK package in use by LAE). If you specially override the command with the JDK, it will add the key correctly.
For those whom need to achieve this. Here are the steps:
1. Use a tool like Portecle application from the internet. Its free
2. Open the tool and click on the Examine Menu, followed by Examine SSL/TLS Connection
3. Fill in the hostname and port number to get the certificates in question
4. For each Cert that comes back, if you click the &quot;PEM Encoding&quot; button, and click Save, you can save the Public Cert to your local disk
5. Add the key into your cacerts key store with the command: /usr/java/jdk1.7.0_07/bin/keytool -importcert -file /tmp/cert2.pem -keystore cacerts -alias acdb2t01
* Note your JDK Path may differ
For more helpful information on setting up the client end of secured JDBC connection, see the following:
http://archive.midrange.com/java400-.../msg00048.html

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: khopkins

Hello,

Thanks for the information but as we currently have 3 server versions on our server (4.5.3, 4.6.1 and 6.1.3) hence the requirement for the upgrade for the two previous versions as mentioned this is not required.
As we currently host the physical system on an external host under a managed service we do not have the abilty to download tools and as we also do not have a JAVA_HOME set i would like to know how we set it.
I assume that if we set the JAVA_HOME correctly to point to where our java is stored then this should start to work but how can we install a .crt certificate into the JDK keystore as the commands above do not work.

Regards,

Keith

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: gmullin

Use the LAE Properties node when connected to v6.1.3 to see what the JAVA_HOME is set to. If its not <LAE_Install_Dir>/jre then its likely not picking up the cacerts file that you want. Check the value in .profile.lavastorm file for what JAVA_HOME is set to, its located in your LAE 6.1.3 installation directory. If it's correct, source it before you start LAE and check the value - echo $JAVA_HOME.

In testing I've found I can use <LAE6.1_Directory>/jre for my JAVA_HOME and v4.5 and v4.6 will work without any issue.

LAE Properties.brg

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: khopkins

I have set the JAVA_HOME to ths location and the nodes still do not connect.
Does the application server, DB and jetty server need to be restarted before picking the location up and how do i add the crt files into the cacert file as i am not certain that this has been done.
If not how do i tell if the certificates have been installed?

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: stonysmith

Yes, you have to restart the Application Server.
It's a bit optional for you to restart Jetty, but it's probably best.
There's no need to restart the database (H2), but restarting it also is probably a good idea.

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: gmullin

Also the following document is for adding a certificate to cacerts file. You can use keytool to add a certificate (I don't think it's limited to just cer encoding). In IE you can download a certificate, for a database I'm not entirely sure how you would get it. Perhaps there's a keytool command to be run on the database server.

You can also use a tool like Portecle (free to download) to read your cacerts file and see what certs are trusted.

Lavastorm Analytics Engine and SSL connections guide v1.0.pdf

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: khopkins

Hi Gerry,

I have asked for the service to get restarted this morning so hopefully this may fix the JAVA_HOME issue, however the certificates may be installed into the sun one and not the java one.
Now i have done that the connections work but i had to force it to use the one located in the jre directory otherwise it didnt work.

Thanks for all your help now we just need to get the salesforce nodes connecting as they are all failing http://community.lavastorm.com/threa...c-requestError

But hopefully a reboot after setting the JAVA_HOME environment variable might fix this also.

Regards,

Keith