Turning on AS2

[senikk]

When turning on AS2 we got this error when sending:

Sending failed Unexpected error during execution of http POST to https://ap.unimicro.no/oxalis/as2: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The same code runned nicely with START.

Oxalis 3.0.0

[senikk]

Tried upgrading to Oxalis 3.0.1, still same issue

[senikk]

Found #168, looking into the information there

[senikk]

InstallCert fixed it :)

[senikk]

In our log we now got:
"Sending failed Unexpected error during execution of http POST to https://ap.unit4.com/oxalis/as2: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors"

Is it something wrong with our installation, Oxalis 3.0.1 or Unit4 installation of Oxalis? Adding with InstallCert for every accesspoint failing seems not like a good solution.

[senikk]

Checking our logs further everyone failing is to https://ap.unit4.com/oxalis/as2 no one else.

[teedjay]

That was a bit strange, UNIT4 has about 80% inbound AS2 right now - and is based of a standard GlobalSign / G2 which should be included in Java default truststore.

I see you have a very old Java VM, could you run the keytool kommand and verify that is contain recent the ROOT CA at least, like this :

keytool -list -keystore </path/to/java/lib/security/cacerts> | grep '3E:45:52:15:09:51:92:E1:B7:5D:37:9F:B1:87:29:8A'

[senikk]

I got a hit for that grep in cacerts but it didn't work until I added ap.unit4.com:443 using InstallCert to the jssecacerts file.

[teedjay]

If you have "jssecacerts" present that one will be used instead of cacerts.

[teedjay]

If you want to use your own "jssecacerts" instead of cacerts I think you'll have to add every CA you want to trust yourself. The "cacerts" that comes shipped with recent Java Runtimes should be enough to run Oxalis.

[senikk]

Telenor have the same problem sending to our accesspoint. Since they also have a lower version of Java than SendRegning/Unit4 hopefully a newer version will fix it.

[pavelsbubens]

We have the same problem with one production server - START protocol works fine, but AS2 fails with "unable to find valid certification path to requested target" exception.
Did check oxalis code and found that SoapDispatcher for START protocol is "patched" for this problem (using eu.peppol.outbound.ssl.AccessPointX509TrustManager).
But As2MessageSender does not.
Is there any reason why START protocol was patched, but AS2 was not patched ?

[aaron-kumar]

installing a cert in "jssecacerts" is not a solution for production system. This is only workaround for development system where we install self-sign certificate.

SSL certificates should be trusted automatically.

@teedjay Are you working on same?

[teedjay]

The reason for AS2 "not beeing patched" is for it to verify some of the PEPPOL AS2 Transport Infrastructure requirements regarding SSL usage, such as :

• "The DestAP MUST implement HTTPS with certificate chains to certificate authorities which would be considered to be trusted by the PEPPOL community."
• "The DestAP URL SHOULD use the default port 443. This assures firewall rules are often setup in advance."
• "The certificate MUST correctly identify the DestAP URL e.g. no self-signed certificates."
• The DestAP URL SHOULD use the default port 443. This assures firewall rules are often setup in advance.
• etc

@aaron-kumar I'm not currently working on something related to this, and it seems like @senikk is about to solve this by adding intermediate certificates so that his server will present the full certificate chain.