Policy XPress SSL Error PKIX Path Building Failed During LDAP Query

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Running a Policy XPress (PX) policy that utilizes an LDAP Query Data Source against a secure UserStore may fail with an SSL-related error. This typically occurs when the Identity Manager application server cannot validate the SSL certificate chain provided by the remote LDAP server.

Error Message: Error creating search context; JBAS011843: Failed instantiate InitialContextFactory com.sun.jndi.ldap.LdapCtxFactory... sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

 

Environment

Identity Manager

Cause

The application server's Java Runtime Environment (JRE) does not trust the certificate presented by the LDAP Data Source. This is common when using self-signed certificates or internal Certificate Authorities (CAs) that have not been imported into the Java truststore.

Resolution

Option 1: Permanent Fix (Recommended) Import the complete certificate chain (Root and Intermediate CAs) into the truststore used by the application server:

1. Identify Java Home: Check the Wildfly standalone.bat or server.log to identify the JAVA_HOME or JRE path being used.
2. Locate cacerts: The truststore is typically located at [JRE_HOME]\lib\security\cacerts.
3. Import Certificate: Use the Java keytool command to import the certificate: keytool -import -trustcacerts -alias ldap_cert -file [certificate_file] -keystore [path_to_cacerts]
4. Restart: Restart the Identity Manager / Wildfly service to apply the changes.

Option 2: Workaround (Testing Only) To verify connectivity without SSL:

1. Open the affected Policy XPress policy.
2. Navigate to the Data tab.
3. Select the Data Source (LDAP Query type).
4. Uncheck the Secure connection option.
5. Save and run a new test.