DocumentationExperience Cloud KCS

SSLHandshakeException PKIX path building failed in Adobe Experience Manager as a Cloud Service

Last update: October 1, 2026

In Adobe Experience Manager as a Cloud Service, a Java-based application server fails to connect to an AEMaaCS endpoint and displays an SSL handshake error with a PKIX path building failed message. This occurs when Java cannot establish a trusted certificate chain for the endpoint. To fix this issue, verify the Java truststore configuration and confirm that the required DigiCert certificates are present and trusted.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service (all versions)
  • Java-based internal application server

Issue/Symptoms

  • Java application fails to connect to an AEMaaCS endpoint with a PKIX path building failed / SSLHandshakeException error.
  • OpenSSL validation from the same server succeeds.

Cause

The Java runtime used by the application does not trust the DigiCert root or intermediate certificates required for the AEMaaCS endpoint, resulting in certificate chain validation failure.

Resolution resolution

Follow the steps below to resolve the issue.

  1. Identify the Java truststore used by your application.By default, this is typically the cacerts file in your Java installation’s security directory.

  2. List the DigiCert certificates in your truststore using the following command.

    1. Replace <path-to-truststore> with your truststore path.
    2. Run: keytool -list -keystore <path-to-truststore> | grep -i "DigiCert"
    3. If prompted, enter the truststore password.

  3. Confirm that the truststore contains the required DigiCert root and intermediate certificates for Adobe Experience Manager as a Cloud Service endpoints.Look for entries such as DigiCert Global Root G2 or other DigiCert root/intermediate certificates.

  4. To view details for a specific DigiCert certificate alias, run:

    keytool -list -v -keystore -alias

  5. Verify that your Java application is using the expected truststore and Java version.

    1. Run:java -version
    2. Ensure there are no custom JVM SSL/truststore settings, such as javax.net.ssl.trustStore or javax.net.ssl.trustStoreType, that override the default truststore.

  6. If OpenSSL validates the certificate chain but Java does not, the issue is likely with the Java truststore configuration or missing DigiCert certificates.

    Note: Do not import additional or duplicate DigiCert certificates unless specifically advised.

  7. After confirming that the required DigiCert certificates are present and that the correct truststore is used, restart your application and verify that the SSL handshake error is resolved.

recommendation-more-help
experience-cloud-kcs-help-kbarticles