AEM SSL certificate validation errors caused by missing or untrusted certificates
Adobe Experience Manager (AEM) outbound HTTPS and mTLS connections fail when the Java runtime, AEM truststore, or local development environment does not trust the remote server certificate chain. This issue occurs when required root or intermediate certificates are missing, certificate chains are incomplete, SSL interception introduces untrusted certificates, or trust relationships change after Java upgrades. To resolve the issue, validate certificates, update truststores, and verify connectivity.
Description description
Environment
Adobe Experience Manager as a Cloud Service (AEMaaCS)
Issue/Symptoms
- The application logs display javax.net.ssl.SSLHandshakeException: PKIX path building failed, indicating that Java cannot build a trusted certification path to the remote endpoint.
- Local development tools such as aio CLI or node-fetch display
SELF_SIGNED_CERT_IN_CHAIN, indicating that an untrusted certificate exists in the SSL chain. - Browsers display Your connection is not private when accessing secured endpoints because the certificate chain is incomplete.
- Local development environments display unable to get local issuer certificate, indicating that the local truststore does not trust the certificate chain.
- Outbound mTLS calls fail even when keystore configuration appears correct.
Root cause
The issue occurs because AEM or the underlying Java runtime does not trust the remote server certificate chain. Missing root or intermediate certificate authorities, incomplete certificate uploads, SSL inspection proxies, Java truststore changes, and local SDK trust validation failures prevent successful SSL handshake validation.
Resolution resolution
Follow these steps to identify and resolve SSL certificate trust issues:
- Identify the certificate validation error by reviewing AEM logs, Cloud Manager CLI output, JVM stack traces, or local development logs for messages such as PKIX path building failed or SELF_SIGNED_CERT_IN_CHAIN.
- Extract the remote server certificate chain by running
openssl s_client -showcerts -connect <host>:443and verify that all certificates in the chain are returned. - Determine the failure category by identifying whether the issue is caused by a missing certificate, an incomplete chain, SSL interception, browser trust issues, or local development trust validation failures.
- Add missing root and intermediate certificates to the AEM truststore. For AEM as a Cloud Service, import certificates through the Global Truststore. For AMS or On-Premise environments, import certificates into the Java truststore by using keytool.
- Upload a complete certificate chain containing leaf, intermediate, and root certificates when browser-based certificate warnings indicate an incomplete chain.
- Resolve local development certificate issues by adding the required corporate CA certificate to the local operating system or Node.js truststore.
- Restart the AEM instance or Java process after truststore updates in AMS or On-Premise environments so that the updated certificates load successfully.
- Validate outbound connectivity by using SSLPoke or application-level API calls and verify that SSL handshake failures no longer occur.
- Validate the resolution by confirming that outbound connections succeed, SSLHandshakeException errors no longer appear in logs, and certificate validation completes successfully.
When to escalate
- SSL handshake failures continue even though the truststore contains the required certificates.
- The certificate chain appears complete, but outbound connections continue to fail.
- SSL inspection or proxy certificates cannot be validated or trusted within the environment.
- Outbound SSL validation remains unsuccessful after truststore updates and connectivity validation.