This article provides instructions for resolving the HTTP invoker remote service SSLHandshakeException when connecting the core server to the scan server over HTTPS.

Symptoms

Could not access HTTP invoker remote service. Nested exception is:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

NOTE: In versions of Palamida EE > 6.6.2, the core server communicates with the scan server over http or https protocol instead of RMI. If the scan server is set up to communicate over https, or if this is a standalone server, then it will be necessary to import the certificate being served by Tomcat from the scan server to be imported into the JDK of the core server to be trusted.

Cause

The core server does not trust the SSL certificate presented by the scan server because it is not in the JDK truststore.

Resolution

On the Scan Server

1. Read the file tomcat/conf/server.xml to make note of the alias of the certificate served by the keystore on that server:

   keystoreFile="codeinsight.jks"
   keyAlias="codeinsight"
   keypass="<your keystore/key password>"

2. Export the certificate from the keystore into a .crt file which can be used to import into another keystore:

   $JAVA_HOME/bin/keytool -export -file codeinsight.crt -alias codeinsight -keystore codeinsight.jks

3. Copy this ,.crt file to the core server to a known location like /tmp.

On the Core Server

1. As a user with root privileges, navigate to the path defined as $JAVA_HOME and copy the palamida.crt file from the scan server to the jre/lib/security location. For example, if $JAVA_HOME is /usr/bin/java/jdk1.8.0_411:

   cd /usr/bin/java/jdk1.8.0_411/jre/lib/security
   cp /tmp/codeinsight.crt 
   cp cacerts cacerts.original
   ../../bin/keytool -import -file codeinsight.crt -keystore cacerts -storepass changeit -alias codeinsight

2. Type yes when prompted to trust the certificate.
3. After making these changes, change to the user running the Code Insight process and restart the Code Insight core server.

   su - codeinsight
   cd $CODEINSIGHT_HOME/tomcat/bin
   ./shutdown.sh
   ./startup.sh