Oracle SOA Suite 12c- PKIX path building failed & unable to find valid certification path to requested target

Hi Everyone, in this blog I'll be writing one of the strange issue that has been encountered while working with a Oracle SOA composite running in Oracle IDAM environment and trying to invoke a SSL based remote service where SSL certification based exception has been thrown during the service invocation.

Environment

• Oracle SOA Suite 12c (HA Mode)
• Oracle IDAM 12c (HA Mode)
• Oracle Linux 7
• External Web Service (SOAP Service)

Problem

Below is the exception thrown when trying to invoke an external webservice (SSL Based) via BPEL process-

<bpelFault><faultType>0</faultType><remoteFault xmlns="http://schemas.oracle.com/bpel/extension"><part name="summary"><summary>oracle.fabric.common.FabricInvocationException: Unable to invoke endpoint URI "https://idam.uppclonline.com/soa-infra/services/default/DefaultOperationalApproval!5.12*soa_69e4734b-d8fe-4edf-b44e-e287f61c2ddf/SMSNotification%23ApprovalProcess/SMSNotification" successfully due to: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

===== reqeust ========

SOAPAction:"processResponse"

Content-Type:text/xml; charset=UTF-8

Content-Length:3354

&lt;env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" 

Cause

Following are the possible cause of this problem-

1. Certificate binds with provided target service is Invalid and not trusted.
2. To invoke any web service exposed on HTTPS client must trust the ssl certificate which binds with web service/ web hosting server. In SOA running on Weblogic uses JDK provided trust store to trust any SSL certificate for inbound and outbound connections.
3. Using DemoTrust.jks in java keystore of Weblogic domain home environment file setDomainEnv.sh in production environment where host machine to remote machine communication is performed.
4. In this scenario, a SOA service running in Host environment is trying to invoke a SSL based SMS service running on a remote environment i.e. SMS service endpoint has https prefix.

Solution

Referring to my blog  Oracle Weblogic Server Importing SSL Keys , we need to perform following steps to overcome this problem-

    

    1. Import SSL certificates (*.cer only i.e. geotrust.cer) at following locations-

• JAVA_HOME
• Location: /usr/java/jdk1.8.0_181-amd64/jre/lib/security/cacerts
• Command: keytool -import -alias <ALIAS_NAME> -keystore <CACERTS_PATH> -file <*.CER CERTIFICATE_PATH> 
• Command:  keytool -import -alias geotrust -keystore /usr/java/jdk1.8.0_181-amd64/jre/lib/security/cacerts -file /home/oracle/Desktop/sslKeys/geotrust.cer
• SOA_DOMAIN_HOME
• Location: /u01/oracle/products/SOA_DOMAIN_HOME/wlserver/server/lib/cacerts
• Command: keytool -import -alias <ALIAS_NAME> -keystore <CACERTS_PATH> -file <*.CER CERTIFICATE_PATH> 
• Example: keytool -import -alias geotrust -keystore /u01/oracle/products/OIG_HOME/wlserver/server/lib/cacerts -file /home/oracle/Desktop/sslKeys/geotrust.cer

Note: Importing the certificates to JAVA_HOME might be optional but has worked in my environment.

    2. Remove Demotrust.jks property from setDomainEnv.sh file as-

        Location: SOA_DOMAIN_HOME/bin/setDomainEnv.sh

        Example: /u01/oracle/products/SOA_DOMAIN_HOME/

        

setDomainEnv.sh

        Now Search for following line 
    EXTRA_JAVA_PROPERTIES="-        Djavax.net.ssl.trustStore=${WL_HOME}/server/lib/DemoTrust.jks ${EXTRA_JAVA_PROPERTIES} -Dsoa.archives.dir=${SOA_ORACLE_HOME}/soa -Dsoa.oracle.home=${SOA_ORACLE_HOME} -Dsoa.instance.home=${DOMAIN_HOME} -Dtangosol.coherence.log=jdk -Djavax.xml.soap.MessageFactory=oracle.j2ee.ws.saaj.soap.MessageFactoryImpl -Dweblogic.transaction.blocking.commit=true -Dweblogic.transaction.blocking.rollback=true -Doracle.xml.schema/Ignore_Duplicate_Components=true -Doracle.xdkjava.compatibility.version=11.1.1 -Doracle.soa.compatibility.version=11.1.1 -Ddisable-implicit-bean-discovery=true"
export EXTRA_JAVA_PROPERTIES

Delete this section from above property

    -Djavax.net.ssl.trustStore=${WL_HOME}/server/lib/DemoTrust.jks ${EXTRA_JAVA_PROPERTIES}

Revised EXTRA_JAVA_PROPERTIES Line should be-

EXTRA_JAVA_PROPERTIES="-Dsoa.archives.dir=${SOA_ORACLE_HOME}/soa -Dsoa.oracle.home=${SOA_ORACLE_HOME} -Dsoa.instance.home=${DOMAIN_HOME} -Dtangosol.coherence.log=jdk -Djavax.xml.soap.MessageFactory=oracle.j2ee.ws.saaj.soap.MessageFactoryImpl -Dweblogic.transaction.blocking.commit=true -Dweblogic.transaction.blocking.rollback=true -Doracle.xml.schema/Ignore_Duplicate_Components=true -Doracle.xdkjava.compatibility.version=11.1.1 -Doracle.soa.compatibility.version=11.1.1 -Ddisable-implicit-bean-discovery=true"
export EXTRA_JAVA_PROPERTIES

3. Restart the SOA Server(s).

4. Retry the composite functionality by testing the SOA service.

Ideally the communication should work smoothly as calling environment has necessary SSL certificates installed at respective locations.