After the upgrade of JVM the APM Team Center not working

book

Article ID: 209520

calendar_today

Updated On:

Products

CA Application Performance Management (APM / Wily / Introscope)

Issue/Introduction

Due to security audit the customer is required to upgrade the JVM that is used by APM (EM, Webview) components.
The customer upgraded the JVM for APM (EM, Webview) components to AdoptOpenJDK (u222-b10).
Upgrade seems successful as both APM (EM, Webview) components.
The issue is with APM Team Center. Can login to APM Team Center, but it loads blank page. Clearing the cache on the webview did not help.

The 

[ERROR] [WebView] The connection with remote resource at https://<EM-hostname>.com:8444/apm/appmap/private/metric/batch has not been established!
2/11/21 05:21:27.571 PM EST [ERROR] [WebView] Unable to establish connection with remote resource at https://<EM-hostname>.com:8444/apm/appmap/private/follower!
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
 at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
 at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
 at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
 at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
 at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
 at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
 at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
 at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
 at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
 at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
 at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:167)
 at com.wily.introscope.webapps.common.APMServerAPIProxy.initiateConnection(APMServerAPIProxy.java:296)
 at com.wily.introscope.webapps.common.APMServerAPIProxy.processRequest(APMServerAPIProxy.java:190)
 at com.wily.introscope.webapps.common.APMServerAPIProxy.doGet(APMServerAPIProxy.java:119)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:687)
 at com.wily.introscope.webapps.common.APMServerAPIProxy.service(APMServerAPIProxy.java:147)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
 at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:865)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1655)
 at com.wily.webserver.filter.RequestLocaleFilter.doFilter(RequestLocaleFilter.java:46)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.XSSFilter.doFilter(XSSFilter.java:32)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.ClickJackFilter.doFilter(ClickJackFilter.java:52)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.WebViewSSOFilter.doFilter(WebViewSSOFilter.java:252)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:176)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.LocaleSwitch.doFilter(LocaleSwitch.java:52)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.BrowserFilter.doFilter(BrowserFilter.java:69)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:71)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.webserver.filter.CustomResponseHeadersFilter.doFilter(CustomResponseHeadersFilter.java:51)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at com.wily.introscope.webapps.common.filter.ForwardedHeadersFilter.doFilter(ForwardedHeadersFilter.java:46)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1634)
 at com.wily.introscope.webview.server.IntroscopeWebView$ConnectionFilter.doFilter(IntroscopeWebView.java:550)
 at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
 at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
 at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
 at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:513)
 at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
 at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
 at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
 at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
 at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1317)
 at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
 at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
 at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
 at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
 at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1219)
 at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
 at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:219)
 at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:724)
 at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
 at org.eclipse.jetty.server.Server.handle(Server.java:531)
 at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
 at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
 at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
 at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
 at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:291)
 at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:151)
 at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
 at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
 at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333)
 at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310)
 at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168)
 at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126)
 at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366)
 at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:762)
 at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:680)
 at java.lang.Thread.run(Thread.java:748)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
 at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
 at sun.security.validator.Validator.validate(Validator.java:262)
 at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
 at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237)
 at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
 at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
 ... 74 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
 at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
 at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
 at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
 ... 80 more

There are 3 error showing up in Team Center UI.

Environment

Release : 10.7.0

Component : APM TEAM CENTER/ACC

Resolution

There are two options available to fix this issue.

1- Import the certificate in new JVM. Review the following TechDoc:

https://knowledge.broadcom.com/external/article?articleId=198712 

2- Copy the older JVM keystore to current JVM.

Stop the webview and EM
Make back up of APM-Home/jre/lib/security/cacerts file that is installed with AdoptOpenJDK.
Copy the ./jre/lib/security/cacerts from Oracle JVM to the AdoptOpenJDK under APM-Home/jre/lib/security/cacerts.
Do this on both EM and webview. 
Start the EM and webview.

Attachments