Forum Discussion

srinidhi12's avatar
srinidhi12
Icon for Cirrostratus rankCirrostratus
Feb 22, 2023

F5 API access from java certificate error

Hi All, I am accessing the F5 API from java, but I get the certificate error on the http request:

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

But I have downloaded the certificate from the F5 portal and imported in the local java keystore.

sudo keytool -importcert -alias f5_api domain -file f5_api_com.crt -keystore cacerts

Still i get the above error. Please let me know I am missing anything.

 

Thanks!

  • It looks like you may have imported the certificate into the trust store and not the issuer of the certificate into your trust store.
    From the screenshot above it looks like The issuer may be different from the certificate.

  • We have wildcard certs for our domains already installed on the F5s for traffic routing. We re-use those same certs for the device certs. All devices have the exact same wildcard cert installed. This means that hitting the UI gets the same publicly signed certificate as hitting traffic vips in that domain.

    This bypasses the need to add certs to the clients, as the public certs are already trusted.

    • srinidhi12's avatar
      srinidhi12
      Icon for Cirrostratus rankCirrostratus

      Hi TimRiker Thanks for the reply, 

      But I am not able to connect the management server (API request) using java. I can see it working if the http call goes through browser. But not through java. 

      • TimRiker's avatar
        TimRiker
        Icon for Cirrocumulus rankCirrocumulus

        What cert are you using as a device cert? Is it a publicly signed cert? if not, it will need to be added to the java cert store. I recommend using a publicly signed wildcard cert for your domain if you have one already.

  • TimRiker Chris_Thuys Thanks for the reply,

    TimRiker I have downloaded the SSL certificate and imported in my java keystore. Do I need to use the Device certificate as well?

    Chris_Thuys Also I am understanding your question, but can you help me with importing the issuer of the certificate. As I am confused in that process. Please let me know the steps if possible.

  • can anyone please let me know the steps to be configured to access the API from java with the SSL certificate installation in jvm. As I am confused with the steps or not sure if I am missing anything.

    The steps I followed:

    • Download the f5_api_com.crt from certificate management->Traffic certificate management ->SSL certificate ->f5_api_com.crt
    • Import it to my jdk using the below command:
    • sudo keytool -importcert -alias f5_api domain -file f5_api_com.crt -keystore cacerts
    • certificate is added successfully.
    • Restarted my system

     

    • srinidhi12's avatar
      srinidhi12
      Icon for Cirrostratus rankCirrostratus

      And after importing I get the below error:

      javax.net.ssl.SSLPeerUnverifiedException: Hostname 10.10.10.10 not verified:

      here 10.10.10.10 is the F5 Management IP

    • srinidhi12's avatar
      srinidhi12
      Icon for Cirrostratus rankCirrostratus

      Hi,

      I just found that I have changed the hostname from the cli  and that is not updated in the device certificate, which is giving the "hostname not verified error" Please let me know how to update the hostname in the device certificate.