RBPM 4.0.2 - JBoss fails to start with - Root exception is javax.net.ssl.SSLHandshakeException

During the startup of JBoss, the following error is received:

Root exception is javax.net.ssl.SSLHandshakeException

Full error:

09:50:12,637 INFO  [STDOUT] FATAL [RBPM] [com.sssw.fw.directory.api.EboDirectoryFactory:<clinit>] An unexpected exception occurred in the directory layer.
com.sssw.fw.exception.EboUnrecoverableSystemException: An unexpected exception occurred in the directory layer.
    at com.sssw.fw.directory.realm.impl.jndildap.EboLdapDirectoryConnection.createBaseContext(EboLdapDirectoryConnection.java:309)
    at com.sssw.fw.directory.realm.impl.jndildap.EboLdapDirectoryConnection.authenticate(EboLdapDirectoryConnection.java:167)
    at com.sssw.fw.directory.realm.impl.jndildap.EboLdapDirectoryConnectionManager.createConnectionArray(EboLdapDirectoryConnectionManager.java:324)
    at com.sssw.fw.directory.realm.impl.jndildap.EboLdapDirectoryConnectionManager.<init>(EboLdapDirectoryConnectionManager.java:100)
    at com.sssw.fw.directory.realm.impl.jndildap.EboJndiLdapDirectoryFactory.createConnectionMgrInstance(EboJndiLdapDirectoryFactory.java:121)
    at com.sssw.fw.directory.api.EboDirectoryFactory$ConnMgrHolder.<clinit>(EboDirectoryFactory.java:75)
    at com.sssw.fw.directory.api.EboDirectoryFactory.getConnMgr(EboDirectoryFactory.java:108)
    at com.sssw.fw.core.SystemConfig$1.run(SystemConfig.java:141)
    at com.sssw.fw.core.SystemConfig$1.run(SystemConfig.java:138)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.sssw.fw.core.SystemConfig.loadReadWriteSettings(SystemConfig.java:138)
    at com.sssw.fw.core.SystemConfigBase.<init>(SystemConfigBase.java:218)
    at com.sssw.fw.core.SystemConfig.<init>(SystemConfig.java:122)
    at com.sssw.fw.core.SystemConfig.<init>(SystemConfig.java:51)
    at com.sssw.fw.core.SystemConfig$SingletonHolder.<clinit>(SystemConfig.java:83)
    at com.sssw.fw.core.SystemConfig.getInstance(SystemConfig.java:104)
    at com.sssw.fw.servlet.InitListener.contextInitialized(InitListener.java:108)
    at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3910)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:4393)
    at org.jboss.web.tomcat.service.deployers.TomcatDeployment.performDeployInternal(TomcatDeployment.java:310)
    at org.jboss.web.tomcat.service.deployers.TomcatDeployment.performDeploy(TomcatDeployment.java:142)
    at org.jboss.web.deployers.AbstractWarDeployment.start(AbstractWarDeployment.java:461)
    at org.jboss.web.deployers.WebModule.startModule(WebModule.java:118)
    at org.jboss.web.deployers.WebModule.start(WebModule.java:97)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:157)
    at org.jboss.mx.server.Invocation.dispatch(Invocation.java:96)
    at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
    at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
    at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:668)
    at org.jboss.system.microcontainer.ServiceProxy.invoke(ServiceProxy.java:206)
    at com.sun.proxy.$Proxy39.start(Unknown Source)
    at org.jboss.system.microcontainer.StartStopLifecycleAction.installAction(StartStopLifecycleAction.java:42)
    at org.jboss.system.microcontainer.StartStopLifecycleAction.installAction(StartStopLifecycleAction.java:37)
    at org.jboss.dependency.plugins.action.SimpleControllerContextAction.simpleInstallAction(SimpleControllerContextAction.java:62)
    at org.jboss.dependency.plugins.action.AccessControllerContextAction.install(AccessControllerContextAction.java:71)
    at org.jboss.dependency.plugins.AbstractControllerContextActions.install(AbstractControllerContextActions.java:51)
    at org.jboss.dependency.plugins.AbstractControllerContext.install(AbstractControllerContext.java:348)
    at org.jboss.system.microcontainer.ServiceControllerContext.install(ServiceControllerContext.java:286)
    at org.jboss.dependency.plugins.AbstractController.install(AbstractController.java:1631)
    at org.jboss.dependency.plugins.AbstractController.incrementState(AbstractController.java:934)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:1082)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:984)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:822)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:553)
    at org.jboss.system.ServiceController.doChange(ServiceController.java:688)
    at org.jboss.system.ServiceController.start(ServiceController.java:460)
    at org.jboss.system.deployers.ServiceDeployer.start(ServiceDeployer.java:163)
    at org.jboss.system.deployers.ServiceDeployer.deploy(ServiceDeployer.java:99)
    at org.jboss.system.deployers.ServiceDeployer.deploy(ServiceDeployer.java:46)
    at org.jboss.deployers.spi.deployer.helpers.AbstractSimpleRealDeployer.internalDeploy(AbstractSimpleRealDeployer.java:62)
    at org.jboss.deployers.spi.deployer.helpers.AbstractRealDeployer.deploy(AbstractRealDeployer.java:50)
    at org.jboss.deployers.plugins.deployers.DeployerWrapper.deploy(DeployerWrapper.java:171)
    at org.jboss.deployers.plugins.deployers.DeployersImpl.doDeploy(DeployersImpl.java:1439)
    at org.jboss.deployers.plugins.deployers.DeployersImpl.doInstallParentFirst(DeployersImpl.java:1157)
    at org.jboss.deployers.plugins.deployers.DeployersImpl.doInstallParentFirst(DeployersImpl.java:1178)
    at org.jboss.deployers.plugins.deployers.DeployersImpl.install(DeployersImpl.java:1098)
    at org.jboss.dependency.plugins.AbstractControllerContext.install(AbstractControllerContext.java:348)
    at org.jboss.dependency.plugins.AbstractController.install(AbstractController.java:1631)
    at org.jboss.dependency.plugins.AbstractController.incrementState(AbstractController.java:934)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:1082)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:984)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:822)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:553)
    at org.jboss.deployers.plugins.deployers.DeployersImpl.process(DeployersImpl.java:781)
    at org.jboss.deployers.plugins.main.MainDeployerImpl.process(MainDeployerImpl.java:702)
    at org.jboss.system.server.profileservice.repository.MainDeployerAdapter.process(MainDeployerAdapter.java:117)
    at org.jboss.system.server.profileservice.repository.ProfileDeployAction.install(ProfileDeployAction.java:70)
    at org.jboss.system.server.profileservice.repository.AbstractProfileAction.install(AbstractProfileAction.java:53)
    at org.jboss.system.server.profileservice.repository.AbstractProfileService.install(AbstractProfileService.java:361)
    at org.jboss.dependency.plugins.AbstractControllerContext.install(AbstractControllerContext.java:348)
    at org.jboss.dependency.plugins.AbstractController.install(AbstractController.java:1631)
    at org.jboss.dependency.plugins.AbstractController.incrementState(AbstractController.java:934)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:1082)
    at org.jboss.dependency.plugins.AbstractController.resolveContexts(AbstractController.java:984)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:822)
    at org.jboss.dependency.plugins.AbstractController.change(AbstractController.java:553)
    at org.jboss.system.server.profileservice.repository.AbstractProfileService.activateProfile(AbstractProfileService.java:306)
    at org.jboss.system.server.profileservice.ProfileServiceBootstrap.start(ProfileServiceBootstrap.java:271)
    at org.jboss.bootstrap.AbstractServerImpl.start(AbstractServerImpl.java:461)
    at org.jboss.Main.boot(Main.java:221)
    at org.jboss.Main$1.run(Main.java:556)
    at java.lang.Thread.run(Thread.java:744)
Caused by: javax.naming.CommunicationException: simple bind failed: lab2.novell.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX pat
09:50:12,638 INFO  [STDOUT] h validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors]
    at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218)
    at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)
    at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
    at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
    at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
    at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
    at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)
    at javax.naming.InitialContext.init(InitialContext.java:242)
    at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:153)
    at com.sssw.fw.directory.realm.impl.jndildap.EboLdapDirectoryConnection.createBaseContext(EboLdapDirectoryConnection.java:297)
    ... 85 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:882)
    at sun.security.ssl.AppInputStream.read(AppInputStream.java:102)
    at java.io.BufferedInputStream.fill(BufferedInputStream.java:235)
    at java.io.BufferedInputStream.read1(BufferedInputStream.java:275)
    at java.io.BufferedInputStream.read(BufferedInputStream.java:334)
    at com.sun.jndi.ldap.Connection.run(Connection.java:853)
    ... 1 more
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:350)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:260)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1323)
    ... 12 more
Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:208)
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:279)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:345)
    ... 18 more

This error typically indicates that the JBoss server could not communicate with the LDAP server due to some SSL issue.
Typically that is caused by an expired certificate on the ldap server, or that JBoss does not have the updated certificate, if the certificate has changed recently.

Here are steps to renew the default ldap certificate for another 2 years, if it is currently expired.

1.  Stop JBoss

for example:  /etc/init.d/jboss_init stop
Shutting down JBoss applicatino server: Shutdown message has been posted to the server.
Server shutdown may take a while - check log files for completion

2.  Stop ndsd with ./ndsd stop

for example: BigDaddy:/etc/init.d # ./ndsd stop
Stopping Novell eDirectory server...
donefind

3.  Stop Tomcat with ./novell-tomcat5 stop

for example: BigDaddy:/etc/init.d # ./novell-tomcat5 stop
Stopping tomcat5: Using CATALINA_BASE: /var/opt/novell/tomcat5
Using CATALINA_HOME: /var/opt/novell/tomcat5
Using CATALINA_TMPDIR: /var/opt/novell/tomcat5/temp
Using JAVA_HOME: /opt/novell/java

4.  Upgrade the expired eDir certs:

for example: BigDaddy:/etc/init.d # ndsconfig upgrade
Enter admin name with context[admin.org]:admin.novell
Enter the password for admin.novell:
Starting the service 'ndsd'... Done.
Configuring Novell eDirectory server with following parameters
Admin name = admin.novell
dibdir path = /var/nds/dib
Extending schema...
For more details view schema extension logfile: /var/nds/schema.log
Schema extended successfully.
Configuring SAS service ...
Successfully configured SAS service
Configuring NMAS service ...
Successfully configured NMAS service
.....

5.  Stop ndsd

for example: BigDaddy:/etc/init.d # ./ndsd stop
Stopping Novell eDirectory server...
done

6.  Start ndsd

for example: BigDaddy:/etc/init.d # ./ndsd start
Starting Novell eDirectory server...
done

7.  Start tomcat

for example: BigDaddy:/etc/init.d # ./novell-tomcat5 start
Starting tomcat5: Using CATALINA_BASE: /var/opt/novell/tomcat5
Using CATALINA_HOME: /var/opt/novell/tomcat5
Using CATALINA_TMPDIR: /var/opt/novell/tomcat5/temp
Using JAVA_HOME: /opt/novell/java

8.  Open configupdate.sh and browse the tree click OK wait for configupdate to close

This step updates allows configupdate to renegotiate with the ldap server and import the updated certificate.

9.  Start jboss.

for example /etc/init.d/jboss_init start
Starting JBoss application server:            done

Related Technical Information Documents:

TID 7017035 - IDM 4.0.2 - Ho to setup https for JBoss / User Application RBPM using the tree Certificate Authority