Java Cert error due to decryption?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Java Cert error due to decryption?

L3 Networker

My organization is in the process of moving from one VPN solution to GlobalProtect. We are seeing several applications being unable to run certain features, or run successfully at all, and the error logs appear similar to this (I say similar because this specific message is from one application, others may vary, but all are similar):

 

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 
A second one:
 
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 
Our workstation team has tried implementing our organization's root and intermediary certificates into a specific Java cert store according to some information they found online, but the error persists. The only change was moving to GlobalProtect. I have found that bypassing our decryption policies on the Palo Alto fixes this issue, but bypassing decryption for things that often reach out to cloud resources (thereby bypassing decryption to huge chunks of the internet) is not fully acceptable.
 
Has anyone experienced anything like this and/or have any suggestions?
 
Thanks!
5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

While I would love to tell you to decrypt everything, somethings just break when you due. I would suggest not decrypting that traffic.

Regards,

Yeah, but then I have to bypass decryption on AWS, Azure, and GCP IP blocks... That seems entirely unreasonable.

Hello,

Yes I agree. However you can use one or more of the other options to get a bit more granular/generic.

OtakarKlier_0-1623870916006.png

 

Regards,

Cyber Elite
Cyber Elite

@Gareth.Doyle,

That's where the URL category would be recommended when creating your exception. So instead of excluding AWS/Azure/GCP, you would focus more on what resources are actually causing the issue and where the Java application is trying to fetch them from. Then just build out an exception for those URLs. 

L7 Applicator

Hi @Gareth.Doyle 

How does you trust path to the root ca look?

Is it root > intermediate > decryption ca? Did you also try to import the decryption ca into the java trust store? And this question might be obvious, but did you make sure to import the CA certs as trusted issuer/CA certs?

  • 3406 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!