topic Re: Path does not chain with any of the trust anchors. SAS DM in Administration and Deployment

Path does not chain with any of the trust anchors. SAS DM

jbond007 — Thu, 09 Jun 2022 04:37:30 GMT

Hi SAS Community,

Need help.

Im renewing a new bundle certificate on windows SAS DM.
I install it on sequence, root > intermediate > cert but are encountering the error
"Path does not chain with any of the trust anchors" but as per checking the details on the certs are correct. CN, OU, etc.

I also added the certificates on Windows CA Store
https://documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/secref/n12036intelplatform00install.htm

im not sure what's wrong with the setup, im thinking can i delete the existing cacerts.jks, cacerts.pem, trustedcerts.jks, trustedcerts.pem and install everything?

Re: Path does not chain with any of the trust anchors. SAS DM

gwootton — Thu, 09 Jun 2022 11:48:47 GMT

Are you adding these all as a single file, or adding the certificates individually? Usually when I see this message it is because the certificates in a file with multiple certificates are in the wrong order.

Re: Path does not chain with any of the trust anchors. SAS DM

jbond007 — Fri, 10 Jun 2022 05:05:51 GMT

Im adding it individually on SDM..

Yes correct. that's why im thinking if i can remove all the contents in the cacerts then reimport.

Re: Path does not chain with any of the trust anchors. SAS DM

gwootton — Fri, 10 Jun 2022 13:00:42 GMT

There is a SDM task to remove certificates, but I'm not sure that would have any impact. You may want to confirm the root CA you are trying to install is indeed a root CA (issued by itself) and only contains the one certificate. This command should output the subject(s) and issuer(s) in a certificate file.

openssl crl2pkcs7 -nocrl -certfile <certificate.pem> | openssl pkcs7 -print_certs -noout

Here's the documentation on removing certificates from the bundle.

Remove Your Certificates from the Trusted CA Bundle
https://go.documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/secref/n0n1y5gwevy312n13h5bm4yf6quy.htm#p1ft87t44wxt36n1a4o834kwd146

Re: Path does not chain with any of the trust anchors. SAS DM

jbond007 — Wed, 15 Jun 2022 02:06:59 GMT

I forgot to reply to this hehe.. so basically i compared the cacerts file and the contents are different from the intermediate cert part. so i removed it through the SDM remove certificates from bundle and then try again to import using the same sequence root>intermediate>cert then it worked 🙂