Java probes fail to start with 'PKIX path building failed' after enabling SQL Server encryption
Article ID: 443833
Updated On:
Products
Issue/Introduction
After configuring DX Unified Infrastructure Management (UIM) with a Microsoft SQL Server database using Force Encryption, several Java-based probes fail to start.
Probes typically affected:
- mon_config_service
- discovery_server
- ems
- maintenance_mode
- qos_processor
- sla_engine
- wasp
Error message in probe logs:
java.sql.SQLException: Cannot create PoolableConnectionFactory ("encrypt" property is set to "true" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.
Environment
- Product: DX Unified Infrastructure Management (UIM)
- Database: Microsoft SQL Server 2017, 2019, or 2022
- Configuration: Always On Availability Groups (AOAG) or Standalone with "Force Encryption" enabled.
Resolution
To fix this, import the SQL Server certificate(s) into the data_engine Trust Store File (.jks) on the Primary Hub for all nodes in the Always On Availability Groups.
Step 1: Get the Certificates
Export the Root CA and any Intermediate CA certificates from your SQL Server’s certificate chain. In AOAG setups, also export the leaf certificates for all nodes (Primary and Secondary). Save these files (e.g., sql_root.cer, sql_node1.cer) to a temporary folder on the UIM server.
Step 2: Import into a new JRE Keystore
Use the command below with the .cer file to create the .jks file for each certificate.
Syntax: keytool -import -alias <alias_name> -file <certificate_file> -keystore <jks_filename> -storepass <password>
Example: "C:\Nimsoft\jre21\jre21.0.10_7\bin\keytool" -import -alias <sql_node1> -file mssqlnode1.cer -keystore C:\Nimsoft\jre21\jre21.0.10_7\lib\security\sql_nodes.jks -storepass Abc@123
Step 3: In the Admin Console or Infrastructure Manager, configure the data_engine TLS v1.2 settings.
Example using IM:
Launch IM, open the data_engine config menu, and go to the Database tab.
Check ‘Enable TLS,’ click Browse, select the sql_nodes.jks file from step 1, and enter the password.
Click Apply, then OK.
Restart the UIM Primary hub robot.
Additional Information
Feedback
