0

Using RAD 8.5.5.2 with the latest TFS plug-in on Windows 7 Professional I get the following error when I attempt to connect to our secure TFS 2015 server. RAD 8.5.5.2 uses the Eclipse 3.6.3 platform.

Connection Failed

com.ibm.jsse2.util.j: PKD( path building failed:
java.security.cert.CertPathBuilderException: PKD(CertPathBuilderImpl
could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued
by CN=State of Missouri, DC = state, DC = mo, DC=us is not trusted;
internal cause is:
java.security.cert.CertPathValidatorException: Certificate chaining error

RAD is installed in C:\Program Files\IBM\SDP and is running as an
administrator. I have imported the TFS server root certificate in
every carets file in the installation files which are

C:\Program
Files\IBM\SDP\runtimes\updi_v7X_64\uninstall\java\lib\security\cacerts
C:\Program
Files\IBM\SDP\runtimes\updi_v7X_64\java\jre\lib\security\cacerts
C:\Program
Files\IBM\SDP\runtimes\base_v7_stub\java\jre\lib\security\carets
C:\Program Files\IBM\SDP\runtimes\base_v7\java\jre\lib\security\carets
C:\Program Files\IBM\SDP\jdk\jre\lib\security\cacerts

I am trying to connect with no server running and no projects in the
workspace so I think the only file which needs the TFS root certificate is C:\Program Files\IBM\SDP\jdk\jre\lib\security\cacerts but when that
did not fix the issue I imported the certificate into the other cacerts files. I also imported the root certificate to my PC.

ponder275
  • 903
  • 2
  • 12
  • 33
  • Did this error only occurs when connecting to the secure TFS2015 server? Did you try to connect to a personal vsts(TFS online version) to narrow the issue if it's related to rad(Eclipse) or TFS server configuration. – PatrickLu-MSFT Dec 27 '16 at 12:27
  • I can connect to TFS with Visual Studio 2015. I can also connect through rad(Eclipse) if I uncheck the Accept Only Trusted Servers box in the TFS Plug-in. (That box is not available on the most recent plug-in). – ponder275 Dec 30 '16 at 15:51

3 Answers3

1

It looks like your server is using a custom SSL that is not in the certificate chain for Java. You need to add it...

https://docs.oracle.com/javase/tutorial/security/toolsign/rstep2.html

You have to use Keytool to get your companies root certificate into the store.

MrHinsh - Martin Hinshelwood
  • 23,409
  • 5
  • 46
  • 69
  • I have added the root certificate and intermediate certificate into the servers Trust Store and it does not fix the issue. I have also added the certificates into the WAS Java cacerts file and that does not help either. We are upgrading to RAD 9.5 soon and it appears the problem goes away with RAD 9.5 so I am just going to work around it until then. IBM and Microsoft have been unable to find a solution for me. – ponder275 Dec 30 '16 at 15:46
0

Do you have a WAS server installed in the workbench? Wondering if this is related to this problem

http://www-01.ibm.com/support/docview.wss?uid=swg1PI41436

If so then delete the WAS server from the Servers view, restart RAD, connect to TFS and then add WAS server again in Servers view.

If I recall correctly, this problem was solved on RAD 9.1.

Hope this helps.

Victor Sosa
  • 388
  • 1
  • 14
  • I don't have any servers created. Thanks for the idea. – ponder275 Dec 06 '16 at 17:52
  • This doesn't look like a simple problem that can be solved through SO. My advice is that you contact IBM Support. Sorry. – Victor Sosa Dec 07 '16 at 23:55
  • I think you are right. I am having a conversation with them and they are researching the issue. If they can solve it I will post the solution. Thanks for your time. – ponder275 Dec 08 '16 at 14:25
0

Your Eclipse version 3.6.3 is out of date. To connect TFS 2015, suggest you to update the RAD version and Eclipse version to latest.

For the old Eclipse version, there has some issues with the default proxy detection. Try to go to Window -> Preferences -> General -> Network Connections and set Proxy to anything other than Native. Such as Direct, Or yo Manual and configure your proxy settings manually.

PatrickLu-MSFT
  • 49,478
  • 5
  • 35
  • 62