ERR: An unexpected SSLHandshakeException occured: PKIX path building failed:

Keo · April 7, 2023, 1:00pm

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue:
hello community ,I’m getting the following error when trying to configure ldaps in opensearch

Configuration:

Relevant Logs or Screenshots:
Will connect to localhost:9200 … done
ERR: An unexpected SSLHandshakeException occured: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
See Java high-level REST client - OpenSearch documentation for troubleshooting.
Trace:
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
See Java high-level REST client - OpenSearch documentation for troubleshooting.
at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:947)
at org.opensearch.client.RestClient.performRequest(RestClient.java:332)
at org.opensearch.client.RestClient.performRequest(RestClient.java:320)
at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:462)
at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:159)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:288)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:356)
at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:547)
at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591)
at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
… 19 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
… 24 more

punkovain · April 7, 2023, 1:20pm

Hello!
Have you added CA cert?

Keo · April 7, 2023, 1:26pm

yes , i did add it to the opensearch.yml config file

network.host: 0.0.0.0

# minimum_master_nodes need to be explicitly set when bound on a public IP

# set to 1 to allow single node clusters

discovery.zen.minimum_master_nodes: 1

Setting network.host to a non-loopback address enables the annoying bootstrap checks. “Single-node” mode disables them again.

discovery.type: single-node

######## Start OpenSearch Security Demo Configuration ########

WARNING: revise all the lines below before you go into production

plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: ldap_cert.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath:esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: ldap_cert.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:

CN=kirk,OU=client,O=client,L=test, C=de
CN=secdojo-WIN-DC-CA,DC=secdojo,DC=lab
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [“all_access”, “security_rest_api_access”]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert*”, “.opendistro-anomaly-results*”, “.opendistro-anomaly-detector*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-", ".opensearch-notifications-”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response*”, “.replication-metadata-store”]

Keo · April 7, 2023, 1:29pm

i exported the certificate from the ldap then i convert it to pem using “openssl x509 -inform DER -in ldaps_cert.cer -out ldaps_cert.pem” but after i run the following command i get the above error

“”/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh" -f “/usr/share/opensearch/config/opensearch-security/config.yml” -icl -key “/usr/share/opensearch/config/kirk-key.pem” -cert “/usr/share/opensearch/config/ldap_cert.pem” -cacert “/usr/share/opensearch/config/root-ca.pem” -nhnv"

punkovain · April 7, 2023, 2:06pm

Okay, thanks for the details.
So, first:

Try to add CA file to config section, like described here: Active Directory and LDAP - OpenSearch documentation
with securityadmin tool you must use admin_cert and root_ca which has been used to issue admin cert and keys.
If yours ldap_cert.pem is not CA cert, replace it here plugins.security.ssl.transport.pemtrustedcas_filepath: ldap_cert.pem by true CA cert.

Keo · April 7, 2023, 7:04pm

hello , its says now Unable to connect to ldapserver 192.168.1.5:636 due to OpenSearchException[Empty file path for plugins.security.ssl.transport.truststore_filepath]. Try next , my config files

opensearch.yml

cluster.name: docker-cluster

Bind to all interfaces because we don’t know what IP address Docker will assign to us.

network.host: 0.0.0.0

### minimum_master_nodes need to be explicitly set when bound on a public IP

# set to 1 to allow single node clusters

##discovery.zen.minimum_master_nodes: 1

####Setting network.host to a non-loopback address enables the annoying bootstrap checks. “Single-node” mode disables them again.

discovery.type: single-node

######## Start OpenSearch Security Demo Configuration ########

WARNING: revise all the lines below before you go into production

plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:

CN=kirk,OU=client,O=client,L=test, C=de

plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [“all_access”, “security_rest_api_access”]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert*”, “.opendistro-anomaly-results*”, “.opendistro-anomaly-detector*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-", ".opensearch-notifications-”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response*”, “.replication-metadata-store”]
node.max_local_storage_nodes: 3
######## End OpenSearch Security Demo Configuration ########

root.ca.pem cert alongside with the ldaps cert

pablo · April 7, 2023, 9:12pm

@Keo If you’re using self-signed certificates with your LDAP server then add LDAP’s certificate to pemtrustedcas_filepath in authc and authz LDAP section in config.yml.

Gsmitt · April 8, 2023, 2:07am

Hey

Adding my 2 cents.

By chance do you have a Keystore and/or truststore files. Normally, when i get that error is because i forgot to add certificate to my keystore when using self-sgned certs. Just a idea.

Configuring TLS certificates - OpenSearch documentation

Keo · April 8, 2023, 4:44pm

thanks @pablo @Gsmitt problem solved

Gsmitt · April 10, 2023, 9:39pm

Glad we could help @Keo

awesome-yes-will-ferrell (1)

Topic		Replies	Views
Securityadmin.sh unable to find valid certification path to requested target error Security configure , security-issue	2	766	November 1, 2023
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Open Source Elasticsearch and Kibana	13	12452	April 16, 2024
Opensearch security plugin with certificate chain Security	10	1684	June 12, 2024
"SSL Problem PKIX path building failed" & "certificate_unknown" when changing admin certificates Security	1	5071	December 18, 2019
Error while executing securityadmin.sh in OS 1.2.4 Security security-issue	19	827	October 26, 2023

ERR: An unexpected SSLHandshakeException occured: PKIX path building failed:

# minimum_master_nodes need to be explicitly set when bound on a public IP

# set to 1 to allow single node clusters

discovery.zen.minimum_master_nodes: 1

Setting network.host to a non-loopback address enables the annoying bootstrap checks. “Single-node” mode disables them again.

discovery.type: single-node

WARNING: revise all the lines below before you go into production

opensearch.yml

Bind to all interfaces because we don’t know what IP address Docker will assign to us.

### minimum_master_nodes need to be explicitly set when bound on a public IP

# set to 1 to allow single node clusters

##discovery.zen.minimum_master_nodes: 1

discovery.type: single-node

WARNING: revise all the lines below before you go into production

root.ca.pem cert alongside with the ldaps cert

Related topics