ServiceNow Adapter fails to collect data in VCF Operations 9.1 with the following error: "org.bouncycastle.tls.TlsFatalAlert: certifcate_unknown(46)"

Products

• VCF Operations

Issue/Introduction

In VCF Operations 9.1, the ServiceNow adapter may enter a 'WARNING' state and stop collecting data. The WARNING shows the following error:

Message: org.bouncycastle.tls.TlsFatalAlert: certifcate_unknown(46)

 

Attempting to remediate the issue by navigating to the ServiceNow adapter instance in the VCF Operations UI and clicking Validate Connection results in a "Failed to read trust store" error in the UI. 

 

VCF Operations nodes OR Cloud Proxy logs will record the following exceptions:

#/storage/log/vcops/log/adapters/ServiceNow/ServiceNowAdapter.log 

ERROR ServiceNowAdapter ####### [ops@#### threadId="685" threadName="Collector worker thread 14" instanceId="#####"] [(#####) com.bluemedora.domainsplice.Synchronizer.error] - org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
javax.net.ssl.SSLException: org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
...
Caused by: java.security.cert.CertificateException: Unable to construct a valid chain
at org.bouncycastle.jsse.provider.ProvX509TrustManager.validateChain(ProvX509TrustManager.java:321)
at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkTrusted(ProvX509TrustManager.java:276)
at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkServerTrusted(ProvX509TrustManager.java:191)
at org.bouncycastle.jsse.provider.ProvSSLEngine.checkServerTrusted(ProvSSLEngine.java:151)
... 24 more
Caused by: java.security.cert.CertPathBuilderException: No issuer certificate for certificate in certification path found.
at org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi_8.engineBuild(Unknown Source)
at java.base/java.security.cert.CertPathBuilder.build(Unknown Source)

Environment

• VCF Operations 9.1

Cause

The ServiceNow adapter requires the ability to read the local trust store on the VCF Operations Cluster nodes to validate the external certificate chain. Due to security hardening implemented in VCF Operations 9.1, the adapter is restricted from reading the trust store, causing the validation to fail.

Resolution

To bypass the trust store read failure and restore data collection, update the adapter instance to skip strict SSL verification, follow the below mentioned steps:

1. Log in to the VCF Operations UI as an admin user (https://<VCF_OPS_FQDN_or_IP>/ui).
2. On the top navigation bar, select Operate.
3. In the left panel, navigate to Administration > Integrations.
4. Select the failing ServiceNow Adapter and click Edit.
5. Expand the Advanced Settings menu.
6. Change the value of the ServiceNow SSL configuration property to 'No Verify'.
7. Click Save.
8. After saving the configuration, wait ~5 minutes for the next collection cycle to trigger. The adapter should successfully bypass the local trust store check and transition back into a Collecting state.