Operator Console portlet fails to load with PKIX path building error after enabling TLS

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

After enabling TLS encryption on the data_engine (connecting to an MS SQL Server database), the operatorconsole_portlet fails to load in the Operator Console (OC). The following error is observed in the wasp.log:

ERROR [main, com.nimsoft.nimbus.probe.service.wasp.Probe] com.microsoft.sqlserver.jdbc.SQLServerException: "encrypt" property is set to "true" and "trustServerCertificate" property is set to "false" but the driver couldn’t establish a secure connection to SQL Server using SSL encryption: Error: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.

Environment

Database: MS SQL Server 2017+ (often in Always On Availability Groups)

UIM Version: 23.4+

Cause

The error occurs because the wasp probe on the Operator Console server lacks the necessary certificate trust to establish a secure connection with the SQL Server.

Specifically, the truststore.jks file located in the Nimsoft\security folder is either missing, corrupted, or does not contain the required certificates. While the wasp probe is designed to automatically copy this file from the Primary Hub during startup, this synchronization process can occasionally fail or be blocked.

In addition, the issue may occur when the database connection is not using a Fully Qualified Domain Name (FQDN), which is a prerequisite for SQL Server TLS connections.

 

Resolution

Step 1: Verify FQDN Requirements

1. Confirm the database server is configured using the Fully Qualified Domain Name (FQDN). Connections using short names or IP addresses may fail during the SSL handshake.

Step 2: Synchronize Truststore

1. Deactivate the wasp probe on the Operator Console robot.

2. Log in to the Operator Console server and navigate to the Nimsoft security directory:

Example: C:\Nimsoft\security\ or E:\Nimsoft\security\

3. Locate the file truststore.jks. If it exists, rename it to truststore.jks.old.

4. Navigate to the Primary Hub server and go to its security directory:

Example: [Path to Nimsoft]\security\

5. Copy the truststore.jks file from the Primary Hub.

6. Paste the file into the security folder on the Operator Console server.

7. Activate the wasp probe.

8. Verify that the wasp.log no longer shows the PKIX path building failed error and that the Operator Console portlets load correctly.