Path does not chain with any of the trust anchors. SAS DM

[jbond007]

Hi SAS Community,

Need help.

Im renewing a new bundle certificate on windows SAS DM. 
I install it on sequence, root > intermediate > cert but are encountering the error 
"Path does not chain with any of the trust anchors" but as per checking the details on the certs are correct. CN, OU, etc. 

I also added the certificates on Windows CA Store
https://documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/secref/n12036intelplatform00install.htm

im not sure what's wrong with the setup, im thinking can i delete the existing cacerts.jks, cacerts.pem, trustedcerts.jks, trustedcerts.pem and install everything?

[gwootton]

Are you adding these all as a single file, or adding the certificates individually? Usually when I see this message it is because the certificates in a file with multiple certificates are in the wrong order.

[jbond007]

Im adding it individually on SDM..

Yes correct. that's why im thinking if i can remove all the contents in the cacerts then reimport.

[gwootton]

There is a SDM task to remove certificates, but I'm not sure that would have any impact. You may want to confirm the root CA you are trying to install is indeed a root CA (issued by itself) and only contains the one certificate. This command should output the subject(s) and issuer(s) in a certificate file.

openssl crl2pkcs7 -nocrl -certfile <certificate.pem> | openssl pkcs7 -print_certs -noout

Here's the documentation on removing certificates from the bundle.

Remove Your Certificates from the Trusted CA Bundle
https://go.documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/secref/n0n1y5gwevy312n13h5bm4yf6quy.htm#p1...

[jbond007]

I forgot to reply to this hehe.. so basically i compared the cacerts file and the contents are different from the intermediate cert part. so i removed it through the SDM remove certificates from bundle and then try again to import using the same sequence root>intermediate>cert then it worked 🙂