Skip to main content

Trust an external server's certificate

Import a certificate into the trust keystore of the Java runtime the iGrafx Platform runs on, so the platform trusts an external server it connects to over TLS — a mail (SMTP) server, an LDAP or Active Directory server, or an iGrafx Process AutomationProcess Automation Executing a modeled process directly via a workflow engine, with human tasks, system calls, and decision logic orchestrated from the model. server.

The platform trusts a TLS certificate only if the certificate, or the certificate authority (CA) that issued it, is in that keystore. A self-signed certificate or one from an internal CA isn't there by default, so the connection fails with PKIX path building failed: … unable to find valid certification path to requested target in the server logs. You'll hit this when the platform sends mail over TLS, when it saves an LDAP or Active Directory configuration over SSL, or when it deploys a process to an iGrafx Process AutomationProcess Automation Executing a modeled process directly via a workflow engine, with human tasks, system calls, and decision logic orchestrated from the model. server that runs on HTTPS.

This page covers the connections the platform makes. For serving the platform itself over HTTPS, see SSL (HTTPS) configuration on Tomcat.

Prerequisites​

  • File-system access to the platform's installation directory on the server, and permission to restart the platform.
  • The certificate to trust, as a file on that server — the external server's own certificate, or the root and intermediate CA certificates that issued it. How you obtain them depends on your network and your organization's policies.

Steps​

  1. Find the lib\security directory of the Java SDK bundled with your installation — the openjdk-<version> folder in the installation directory. The trust keystore is the cacerts file there. Its default password is changeit.

    warning

    Back up cacerts before you change it. An upgrade replaces the bundled Java SDK, so re-import your certificates after upgrading the platform.

  2. Copy your certificate files into that lib\security directory.

  3. Open a command line in the lib\security directory.

  4. Import each certificate, giving it an alias that's unique within the keystore (the file name without its extension works well):

    ..\..\bin\keytool.exe -import -trustcacerts -alias MY_ALIAS -file MY_CERT.cer -keystore cacerts -storepass changeit

    Repeat the command for every certificate in the chain you were given — typically the root CA certificate, then any intermediates.

    If what you have is a PKCS#12 bundle (.pfx) rather than individual certificate files, import the bundle instead. keytool prompts for the destination keystore password (changeit) and then the source keystore's password:

    ..\..\bin\keytool.exe -importkeystore -srckeystore MY_CERT.pfx -srcstoretype PKCS12 -destkeystore cacerts

  5. Restart the iGrafx Platform.

Verify​

Retry the operation that failed, and confirm the PKIX path building failed error no longer appears in the server logs:

  • Mail server — send a test email from Admin → Email Management.
  • LDAP or Active Directory — save the directory configuration.
  • iGrafx Process AutomationProcess Automation Executing a modeled process directly via a workflow engine, with human tasks, system calls, and decision logic orchestrated from the model. — deploy a process to the Automation server.

To confirm a certificate is in the keystore, list it by alias:

..\..\bin\keytool.exe -list -alias MY_ALIAS -keystore cacerts -storepass changeit

Troubleshooting​