IPA webrun connection error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBu

Invalid certificate error for IPA webservice connection. We are getting an error message when we send a webrun HTTP POST to another server.
Has anyone seen this and have a suggestion to fix the issue.

WebRun WebRun7080: Request header - {Content-Type=[text/xml]}
Activity failed: WebRun7080
Variables in Process:
lastOutputData =
lastInformationCode = 0
lastErrorCode = 1
lastReturnMessage = sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

WebRun7080_errorCode = 1
WebRun7080_informationCode = 0
WebRun7080_returnMessage = sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
WebRun7080_outputData =
WebRun WebRun7080: Failed with error javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)

Find more posts tagged with

Process Automation (IPA) - General Discussions

Accepted answers

All comments

cleverly

The error means that the remote host you are contacting presented a certificate signed by an a certificate authority unknown to the JVM running IPA.

This will always happen, for example, in the case of the remote host using a self-signed certificate. (It could also happen if they are using a certificate from an obscure country or regional CA that your JVM does not have.)

If you trust the remote host, you can import their public cert into your JVM's trust store (using the JVM's keytool utility).

unknown

The Certificate we used is a commercial certificate by Digicert which is a commonly used cert.
Shoudn't JVM have all the common public certificate authorities? or is that something that has to be always added.

cleverly

Your JVM probably has the root DigiCert CA. It might not have all of the DigiCert intermediary CA certs.

If the remote host is configured to send its cert + the intermediate then the JVM would be able to tell that the intermediate was signed by the DigiCert root, and that the server cert was signed by the intermediate. But even if your JVM trusts the root DigiCert CA, without the intermediate the chain from root -> intermediate -> host is broken.

If your server is public facing, a quick way to test whether or not it is configured to send its cert + the intermediary, is to use DigiCert's SSL Certificate Checker at: https://www.digicert.com/help/

If it isn't public facing, but you can connect to it via a browser, click on the padlock icon and view the certificate and see how what's being returned. (Chrome: Padlock > Connection Is Secure > Certificate Is Valid).

On community.infor.com, here, for example, you can see the chain:

unknown

thanks for the information, but I found that I had selected the incorrect 'Configuration name' on the node. The next problem that I had with the web run node was getting the correct post string for the 'AddAttachment' action because every time i attempted to use google dev tools to see the command sent on an attachment add my browsers would all freeze and crash. I was able to use EDGE browser and its dev tools to get the needed information for the 'addAtachment' command to get that to work as needed.

0712131256598360.doc

unknown

Our server isn't public facing.

The site shows secure. I'll pass on your suggestions to the Lawson Support team.

Thank you

russel-cornelson

The solution to this problem is definitely to load the certificates into the cacerts store for the Java that is running the LPA Grid node using keytool command. If you have an open incident with Infor Support can you email the incident number @ russel.cornelson@infor.com

Copyright © 2025 Infor. All rights reserved.