SSL Problems

[vedeht]

We recently replaced the SSL certificate on our horizon servers and now we are receiving this error.  Any suggestions?

We use a godaddy wildcard ssl certificate.

Request failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[opie551]

This means that there is an issue with the Root CA and Intermediate CA certs on the rest of the appliances.  Follow these directions to correct the problem:

• Copy both CA (root and issuing ) certs in PEM format to /etc/ssl/certs/ on all 5 VMs in the VApp. I’ve named the files root-ca.pem and issuing-ca.pem respectively. I’ve enabled root ssh on all the VMs so was able to use scp to get them on each VM. Otherwise you could log into the VM console of each one and pull them in.
• Run c_rehash
• On both the service and connector VMs run the following two command:For the root CA: /usr/java/jre1.6.0_37/bin/keytool -import -trustcacerts -file /etc/ssl/certs/corp-root-ca1.pem -alias corp-root-ca -keystore /usr/java/jre-vmware/lib/security/cacertsFor the issuing CA: /usr/java/jre1.6.0_37/bin/keytool -import -trustcacerts -file /etc/ssl/certs/corp-issuing-ca1.pem -alias corp-issuing-ca -keystore /usr/java/jre-vmware/lib/security/cacerts
• On the data VM run:
  • /opt/zimbra/jdk1.7.0_05/jre/bin/keytool -import -trustcacerts -file /etc/ssl/certs/corp-root-ca1.pem -alias corp-root-ca -keystore /opt/zimbra/jdk1.7.0_05/jre/lib/security/cacerts
  • /opt/zimbra/jdk1.7.0_05/jre/bin/keytool -import -trustcacerts -file /etc/ssl/certs/corp-issuing-ca1.pem -alias corp-issuing-ca -keystore /opt/zimbra/jdk1.7.0_05/jre/lib/security/cacerts

Carlos' Corner Blog has this information but he is relating it to MS Certs but it works for any SSL cert that you are having a problem with.

Adding MS signed Certs to Horizon Workspace « Carlos' Corner

[vedeht]

That got me part of the way.  Unfortunately there are some passwords, etc that aren't really documented to get this updated.  Here is a document I created on how I accomplished it.

How to Update SSL certificates on Horizon Workspace