SSL Handshake Errors when Connecting Pentaho Kettle to Identity Suite vApp

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When connecting the Pentaho Kettle data-integration tool to the Identity Suite Virtual Appliance (vApp), users may encounter an SSLHandshakeException.

This error is typically logged as java.security.cert.CertificateException: No subject alternative names present, preventing the tool from establishing a secure connection to the appliance.

Environment

Identity Suite vApp 14.x

Cause

The default self-signed certificate included with the Identity Suite vApp does not contain the required "Subject Alternative Names" (SAN) extension.

Modern Java clients, including Pentaho Kettle, strictly validate this extension during the SSL handshake process to ensure the certificate matches the hostname, causing the connection to fail.

Resolution

To resolve this connectivity issue, choose one of the following methods:

1. Deploy a Custom Certificate (Recommended): Install a custom certificate on the Identity Suite vApp that includes Subject Alternative Names (SANs) defined for the appliance's hostname or IP address. Use one of these defined names when configuring the Pentaho connection.
2. Use HTTP Connection (Alternative): Modify the connection URL within the Pentaho tool to utilize HTTP instead of HTTPS: http://<vAppIPAddress>:8082

Note: Option 2 bypasses SSL encryption. Ensure this aligns with your organization's security policy.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.