Skip to Content
Last modified by Erik Bakker on 2024/09/03 13:24
From version 38.1
edited by Erik Bakker
on 2022/06/13 16:06
Change comment: Deleted image "rca-knowledgebase-unable-to-find-valid-certification-path--truststore-config-and-emagiz-config.png"
To version 39.1
edited by Erik Bakker
on 2022/06/14 08:07
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -3,19 +3,17 @@
3 3  
4 4  Should you have any questions, please get in touch with academy@emagiz.com.
5 5  
6 -== 3. Unable to find valid certification path ==
6 +== 1. Situation ==
7 7  
8 -=== 3.1 Situation ===
9 -
10 10  On a specific working day, a connection between eMagiz and an external REST service broke down due to errors related to certificate problems. The external party updated the trusted certificates, but they did not notify the client team working on the eMagiz solution.
11 11  
12 -=== 3.2 Problem ===
10 +== 2. Problem ==
13 13  
14 14  As a result of these actions, no data could be supplied to the system before the problem was resolved.
15 15  
16 -=== 3.3 Analysis ===
14 +== 3. Analysis ==
17 17  
18 -==== 3.3.1 Errors in eMagiz ====
16 +=== 3.1 Errors in eMagiz ===
19 19  
20 20  To analyze the problem, we first looked at the errors within the environment to get a sense of the issue at hand. See below for the errors we saw.
21 21  
... ... @@ -23,7 +23,7 @@
23 23  
24 24  [[image:Main.Images.RCA-Knowledgebase.WebHome@rca-knowledgebase-unable-to-find-valid-certification-path--errors-in-emagiz-part-two.png]]
25 25  
26 -==== 3.3.2 Call endpoint in Postman with SSL verification on ====
24 +=== 3.2 Call endpoint in Postman with SSL verification on ===
27 27  
28 28  Secondly, we navigated to the endpoint via the browser to determine the certificate chain of the external party. Once we had established the certificate chain, we tested the connection via Postman.
29 29  When calling the external application with SSL verification turned on but no Certificates configured, we get the below error. This indicates that Postman does not trust the external party enough to establish a proper connection.
... ... @@ -34,13 +34,13 @@
34 34  
35 35  [[image:Main.Images.RCA-Knowledgebase.WebHome@rca-knowledgebase-unable-to-find-valid-certification-path--postman-ssl-verification-on-configured-cert.png]]
36 36  
37 -==== 3.3.3 Truststore configuration and configuration in eMagiz ====
35 +=== 3.3 Truststore configuration and configuration in eMagiz ===
38 38  
39 39  With these results, we have added the intermediate and the CA certificate to a custom truststore for the external party and linked the truststore to the HTTP outbound gateway.
40 40  
41 41  [[image:Main.Images.RCA-Knowledgebase.WebHome@rca-knowledgebase-unable-to-find-valid-certification-path--truststore-config-and-emagiz-config.png]]
42 42  
43 -=== 3.4 Result ===
41 +== 4. Result ==
44 44  
45 45  The analysis concluded that there is a mismatch between the certificates used at the external party and those on default trusted by various software parties (including Java). The best course of action would be to use a certificate structure in which the entire certificate chain (intermediate and CA) is trusted adequately on default. This removes the need for custom configuration in the form of a custom truststore that needs to be managed at the eMagiz side and updated every time the external parties certificate changes.
46 46