FSLOGIN SSL issue

[sathya66]

All,

I ran FSLOGIN macro code.I am getting below error, it is because of SSL issue ( PLIX path building failed and unable to find the certificate path ).

we have certificates in place everything looks fine as I can access forecast studio client and E miner client and also web apps .

sassw.config is also pointing to mid ter server xml .

I see below link and it is useful but looking for sas one.

https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-fail...

28 %FSLOGIN(USER=test_user, PASSWORD=XXXXXX,
29 SASENVIRONMENT=default);
NOTE: Assuming default middle-tier name based on login type: fsmain

ERROR: Exception caught in FSLOGIN.
ERROR: ENVIRONMENT_LOAD_FAILED
09-22 11:55:24,763 [Thread-4][FATAL XmlEnvironmentManager] - Unable to properly initialize EnvironmentManager (IOException) using
the provided URL (https://testmidtier.com:8343/sas/sas-environment.xml)
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)

[AnandVyas]

SSL issues can be tricky. Just try to check where the macro is getting triggered and what’s the Java path being used during the startup. This will give an better understanding to troubleshoot.

[sathya66]

Macro is in compute for sure. How can I check the java path? do I need to enable debug option to check?

[AnandVyas]

Are the root and intermediate certificates imported in compute server?

[sathya66]

Thanks,
Yes,We are missing root and sub certificates in compute in Dev .
we have these in pem format , Please can I get code for converting these pem certificates into .crt format?

ex: openssl x509 -outform der -in your-cert.pem -out your-cert.crt ?

I found these useful but not code for.crt

https://documentation.sas.com/?docsetId=secref&docsetTarget=n0z2rzwzxh81czn12ughc6fpoh1s.htm&docsetV...

https://documentation.sas.com/?docsetId=secref&docsetTarget=n0psn4y523yrgyn19rs5vryoeu20.htm&docsetV...

[AnandVyas]

openssl x509 -outform der -in your-cert.pem -out your-cert.crt

Try this

[sathya66]

Thanks,
I converted that to .crt format but I am getting below error when I try to apply to Trusted CA bundle
Error: Certificate file is not Base-64 encoded:
/tmp/root.crt.
Verify that the file contains certificates in the proper encoding.

[AnandVyas]

Open the certificate in windows machine and export it to the required format. Just google on the steps or check this link if it helps: https://community.tenable.com/s/article/How-to-export-certificate-in-PEM-format-for-import-from-Wind...