We Keep Coding

Certificate chain handed over to graylog for internal communication doesn't work

I have stored a correct certificate in the Graylog configuration file, in the correct format. The web interface is also accessible via https. However, I get the following error message:
WARN [ProxiedResource] Unable to call https://<...>/api/system/metrics/multiple on node <...>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
WARN [ProxiedResource] Unable to call https://<...>/api/system/inputstates on node <...>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I work on Debian 10 with Graylog 5.0
My Server conf
hope someone can help me
I have stored a correct certificate in the Graylog configuration file, in the correct format. The web interface is also accessible via https. However, I get the following error message.
I have also packed the certificate chain into the cacerts file from elastic via keytool
Last time I was able to work around it by adding a local dns entry to the hosts file, which set the Hostname to the public IP (the certificate did not contain the ip. But now it is)
or do I have the wrong approach?

At first search for the cacerts for graylog
sudo find / -name cacerts
then put in the cert chain via keytool
sudo keytool -import -keystore /usr/share/graylog-server/jvm/lib/security/cacerts -file /etc/ssl/certs/gray.pem
Once this was done it started working.

How to connect a certificate for mail access gmail.com in Java

I'm reviewing a training project - working with a mail server gmail.com. An error occurred at startup:
Failed receive: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
On this site I found instructions on how to connect the certificate: PKIX path building failed” and “unable to find valid certification path to requested target
I'm reviewing a training project - working with a mail server gmail.com. An error occurred at startup:
Failed receive: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
On this site I found instructions on how to connect the certificate: PKIX path building failed” and " unable to find valid certification path to requested target
I did everything according to the instructions:
In chrome, I downloaded the certificate from this site, saved it to the mg mail.cer file
I connected it with the command
keytool -import -alias gmail -keystore c:\Development\Java\jdk11\lib\security\cacerts -file m gmail.com
I overloaded the computer, but the error still remains
I check with the command
keytool -list -trustcacerts -keystore "%JAVA_HOME%\lib\security\cacerts" -storepass changeit
the certificate is in the list:
mgmail, 2 февр. 2021 г., trustedCertEntry,
Certificate fingerprint (SHA-256): 9A:63:32:BE:95:...
What did I miss?

According to this error, It seems like you haven't imported the full cert chain to the trust store (root, intermediate and leaf certs).
enter image description here
In Firefox, You can easily download the full certificate chain. Then please import all 3 certificates to your trust store.

How to add the certificate for the Confluent Platform in a SSO environment

I'm setting up a Docker container of the Confluent Platform, and I'm getting the javax.net.ssl.SSLHandshakeException error. Which certificate do I add?
The reason why I'm using Docker is due to my laptop being a windows device. I've installed the latest version of Java/cloned the latest images for the Confluent Platform.
I've added the certificate for "*.confluent.io" into cacerts for my JRE.
I think this issue is due to my environment being a closed Single Sign On environment. So this is where I am stuck.
The specific error message that I get when setting up docker compose with the CP image is
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Error: Unknown error
ERROR: Service 'connect' failed to build: The command '/bin/sh -c confluent-hub install --no-prompt confluentinc/kafka-connect-datagen:latest' returned a non-zero code: 7
This is the error I get when I use
curl https://api.hub.confluent.io/api/plugins
curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.

Jenkins to slave machine connection got broken after updating the SSL certs?

Recently the cert got expired both on Jenkins server (Linux) and IIS server (windows) and we have imported the new certs for both Jenkins and remote slave.
post that it was able to connect when we launch through browser (but pop up with java - (The certificate is not valid and cannot be used to verify the identity of this website) and if we install Jenkins as a service on windows machine it was in starting state (not proceeding with the Running state) and unable to start the Jenkins as slave in logs
i can see this error as following:
"Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"

Your certs are not correct. Make sure the values for CN and hostname on the cert you imported are the same as the old cert. Make sure you have the intermediate and root certificates imported/trusted as well, as those may have changed with the new certs.
Windows: certlm to check that the intermediate and root certificates are also trusted.

PKIX path building failed. Self-signed SSL certificates

I created server and client keystore.jks and truststore.jks pairs.
server-truststore.jks contains client-public.cer, client-truststore.jks contains server-public.cer.
SSL certificates have no CAs, are self-signed ones. If I play the communication locally it works. But after deploying my server I get the exception:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I've tried to put my server/client certificates into carcerts of java security, it didn't help.
The communication only works if I call my WS from SOAP UI. (For SOAP UI I don't need to use truststore.jks)
I checked it out with a famous SSLPoke.class
$ java SSLPoke HOST 443
Successfully connected
$ java -Djavax.net.ssl.trustStore=truststore.jks SSLPoke HOST 443
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
What could solve it?