Support Article
Failed to get JWK keys error
SA-94657
Summary
Error message displays on updating a Keystore URL in a Keystore rule.
Error Messages
Keystore source URL - Failed to get JWK Keys on the UI
The below error is generated in the PegaRULES.log:
(internal.util.KeyStoreUtilsImpl) ERROR - Failed to get JWK Keys javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[?:1.8.0_171]
Steps to Reproduce
- Create a Keystore rule.
- Select Reference to URL.
- Add the JSON Web Key (JWK) key endpoint URL which the external identity server provides.
Root Cause
The Pega server JVM does not have the certificate from the external identity server in its TrustStore.
Resolution
Add the full certificate chain (ROOT and intermediate) to the Pega application server JVM cacerts.
Published December 2, 2021
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.