topic Re: Machine Agent Throws SSL Error in Splunk AppDynamics

Machine Agent Throws SSL Error

CommunityUser — Tue, 02 Jan 2018 12:08:34 GMT

Machine agent is conneting to Controller throught Proxy, We are getting below error in Machine Agent Log.

Not possible to provide complete Log from the Prod environment, as it is locked down.

I can do a Webex to show the same.

AD Thread Pool-Global0] 20 Dec 2017 11:37:16,390 WARN SystemAgent - Certificate chain validation failed sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target attempting validation.
[AD Thread Pool-Global0] 20 Dec 2017 11:37:16,390 ERROR SystemAgentPollingForUpdate - Fatal transport error while connecting to URL [/controller/instance/96/systemagentpolling]: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Re: Machine Agent Throws SSL Error

CommunityUser — Tue, 02 Jan 2018 21:37:35 GMT

Looks like you are using SSL, are you sure you have the keystore file under the <machine_agent_home>\conf folder?

Re: Machine Agent Throws SSL Error

CommunityUser — Wed, 03 Jan 2018 04:31:53 GMT

Hi Gurmista,

Thanks. Yes we are using SSL. By keystore file you mean the SSL Certificate file ? Where do you get this keystore file ?

Regards,

Muktabh

Re: Machine Agent Throws SSL Error

Saradhi_Pothara — Wed, 03 Jan 2018 09:54:34 GMT

Hi Muktabh,

Following article explains how you configure machine agent for SSL and how to extract the certs.

https://docs.appdynamics.com/display/PRO44/Enable+SSL+for+Standalone+Machine+Agent

If your configuration is to make machine agent connect through a reverse proxy which in turn connects to the Contoller, then the SSL endpoint would be your proxy and in that case you would need to import the certs that are configured on your proxy into the machine agent truststore (cacerts.jks).

Regards,
Saradhi