topic Re: FSLOGIN SSL issue in Administration and Deployment

FSLOGIN SSL issue

sathya66 — Tue, 22 Sep 2020 11:11:22 GMT

All,

I ran FSLOGIN macro code.I am getting below error, it is because of SSL issue ( PLIX path building failed and unable to find the certificate path ).

we have certificates in place everything looks fine as I can access forecast studio client and E miner client and also web apps .

sassw.config is also pointing to mid ter server xml .

I see below link and it is useful but looking for sas one.

https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html

28 %FSLOGIN(USER=test_user, PASSWORD=XXXXXX,
29 SASENVIRONMENT=default);
NOTE: Assuming default middle-tier name based on login type: fsmain

ERROR: Exception caught in FSLOGIN.
ERROR: ENVIRONMENT_LOAD_FAILED
09-22 11:55:24,763 [Thread-4][FATAL XmlEnvironmentManager] - Unable to properly initialize EnvironmentManager (IOException) using
the provided URL (https://testmidtier.com:8343/sas/sas-environment.xml)
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)

Re: FSLOGIN SSL issue

AnandVyas — Tue, 22 Sep 2020 14:28:21 GMT

SSL issues can be tricky. Just try to check where the macro is getting triggered and what’s the Java path being used during the startup. This will give an better understanding to troubleshoot.

Re: FSLOGIN SSL issue

sathya66 — Tue, 22 Sep 2020 15:22:39 GMT

Macro is in compute for sure. How can I check the java path? do I need to enable debug option to check?

Re: FSLOGIN SSL issue

AnandVyas — Tue, 22 Sep 2020 15:28:13 GMT

Are the root and intermediate certificates imported in compute server?

Re: FSLOGIN SSL issue

sathya66 — Wed, 23 Sep 2020 07:47:58 GMT

Thanks,
Yes,We are missing root and sub certificates in compute in Dev .
we have these in pem format , Please can I get code for converting these pem certificates into .crt format?

ex: openssl x509 -outform der -in your-cert.pem -out your-cert.crt ?

I found these useful but not code for.crt

https://documentation.sas.com/?docsetId=secref&docsetTarget=n0z2rzwzxh81czn12ughc6fpoh1s.htm&docsetVersion=9.4&locale=en

https://documentation.sas.com/?docsetId=secref&docsetTarget=n0psn4y523yrgyn19rs5vryoeu20.htm&docsetVersion=3.1&locale=en

Re: FSLOGIN SSL issue

AnandVyas — Wed, 23 Sep 2020 07:46:12 GMT

openssl x509 -outform der -in your-cert.pem -out your-cert.crt

Try this

Re: FSLOGIN SSL issue

sathya66 — Wed, 23 Sep 2020 08:16:04 GMT

Thanks,
I converted that to .crt format but I am getting below error when I try to apply to Trusted CA bundle
Error: Certificate file is not Base-64 encoded:
/tmp/root.crt.
Verify that the file contains certificates in the proper encoding.

Re: FSLOGIN SSL issue

AnandVyas — Fri, 25 Sep 2020 15:37:21 GMT

Open the certificate in windows machine and export it to the required format. Just google on the steps or check this link if it helps: https://community.tenable.com/s/article/How-to-export-certificate-in-PEM-format-for-import-from-Windows