HTTP job fails with exit code -1 and "No trusted certificate found" error.

Products

• Workload Automation Agent
• ESP dSeries Workload Automation - Scheduler (dSeries)
• ESP dSeries Workload Automation - System Agent (dSeries)
• ESP dSeries Workload Automation - Business Agents (dSeries)

Issue/Introduction

An HTTP job (e.g., used to retrieve an OAuth token) fails with a status code of -1. The job output typically shows one of the following errors:

 

• java.net.SocketException: Socket is closed

• javax.net.ssl.SSLHandshakeException: No trusted certificate found

• java.net.NoRouteToHostException: No route to host

Cause

The failure is typically due to one of the following environmental or configuration factors:

Missing Certificates: The Java runtime environment (JRE) used by the agent does not trust the Oauth provider's certificate (often an internal CA certificate).

Network/Routing: The agent machine cannot reach the specified host on the designated port (e.g., port 8443).

Malformed Provider URL: The port may be missing from the provider URL or the hostname may be unresolvable from the agent machine

Resolution

Try one or both of the following to resolve the issue:

1. Validate Network Connectivity

Run a curl command from the agent machine to verify connectivity.  Ensure the hostname is resolvable (e.g., using nslookup) and the port (typically 443 or 8443) is open.

2. Configure SSL Certificate Acceptance

If the issue is a handshake failure due to an untrusted certificate, configure the agent to automatically accept new CA certificates.  Open the agentparm.txt file in the agent installation directory and add the following parameter:

https.client.ssl.accept_new_ca=true

 

 

 

Additional Information

Note on Curl vs. Java: curl is a simple client that does not have the same security features as the Workload Automation Agent. A successful curl test confirms the host is reachable but does not guarantee the WA Agent's Java keystore is correctly configured