Java Cert error due to decryption?

[Gareth.Doyle]

My organization is in the process of moving from one VPN solution to GlobalProtect. We are seeing several applications being unable to run certain features, or run successfully at all, and the error logs appear similar to this (I say similar because this specific message is from one application, others may vary, but all are similar):

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

A second one:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Our workstation team has tried implementing our organization's root and intermediary certificates into a specific Java cert store according to some information they found online, but the error persists. The only change was moving to GlobalProtect. I have found that bypassing our decryption policies on the Palo Alto fixes this issue, but bypassing decryption for things that often reach out to cloud resources (thereby bypassing decryption to huge chunks of the internet) is not fully acceptable.

Has anyone experienced anything like this and/or have any suggestions?

Thanks!

[vsys_remo]

Hi @Gareth.Doyle 

How does you trust path to the root ca look?

Is it root > intermediate > decryption ca? Did you also try to import the decryption ca into the java trust store? And this question might be obvious, but did you make sure to import the CA certs as trusted issuer/CA certs?