Re: SSL Certificate error when accessing API from IBM i

Nick,

The external API may have changed its Certificate Authority (CA) to one that your DCM or Java store doesn’t contain. For example, by default, the IBM i does not include CA certificates from LetsEncrypt.
If so, this tutorial explains how to find out:
https://docs.bvstools.com/home/ssl-documentation/exporting-certificate-authorities-cas-from-a-website
and how to import into DCM:
https://docs.bvstools.com/home/ssl-documentation/importing-a-certificate-authority-ca-new
and into a Java keystore.
https://www.ibm.com/support/pages/configuring-ibm-i-java-client-applications-tlshttps-secure-communications

Let us know if this helps.


Alan Seiden
https://www.seidengroup.com <https://www.seidengroup.com/>

On Feb 4, 2025, at 3:54 PM, Nick Stoltzfus via WEB400 <web400@xxxxxxxxxxxxxxxxxx> wrote:

We're getting the error below when we try to connect to an external API from the IBM i. We were previously able to connect to it without error and without downloading anything to the IBM i or installing anything with DCM. The API provider created a new certificate and now we get this. Does anybody have any idea what can be done to resolve it?
com.pjx.cfo.multicast.MulticastException: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.ValidatorException: PKIX path building failed: com.ibm.security.cert.IBMCertPathBuilderException: unable to find valid certification path to requested target at com.pjx.xaf.multicast.handler.HttpHandler.sendMessageProtected(HttpHandler.java:158) at com.pjx.xaf.multicast.handler.AbstractHandler.sendMessage(AbstractHandler.java:168) at com.pjx.slo.SLOServerProcessor.resendMessage(SLOServerProcessor.java:388) at com.pjx.slo.SLOServerProcessor.processMessage(SLOServerProcessor.java:217) at com.pjx.slo.SLOServerProcessor.processMessages(SLOServerProcessor.java:163) at com.pjx.slo.SLOServerProcessor.run(SLOServerProcessor.java:105) at java.lang.Thread.run(Thread.java:825)
Thanks,
Nick
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.