DocumentationExperience Cloud KCS

MSSL replication failures in AEM 6.5.1 due to missing SSL client certificate authentication handler

Last update: October 9, 2026

This article explains how to resolve MSSL replication failures in Adobe Experience Manager (AEM) 6.5.1 when the SSL client certificate authentication handler bundle is missing, including steps to address related KeyStore initialization errors.

Description description

Environment

  • Adobe Experience Manager (AEM) 6.5.1

Issue/Symptoms

  • MSSL (Mutual SSL) replication fails even when HTTPS and KeyStore/TrustStore are configured correctly.
  • Replication attempts result in 401 Unauthorized errors.
  • The system may fall back to Basic authentication.
  • After resolving the missing handler, a KeyStoreNotInitialisedException occurs if service user mapping for truststore access is not configured.

Cause

The required SSL client certificate authentication handler bundle is missing from the AEM 6.5.1 environment. Additionally, missing service user mapping for truststore access can cause KeyStore initialization errors.

Resolution resolution

To fix MSSL replication failures caused by a missing SSL client certificate authentication handler, follow these steps:

  1. Check if the SSL client certificate authentication handler bundle is present in your AEM 6.5.1 environment.
  2. If the bundle is missing, obtain and install the appropriate fix for your AEM version through Adobe Support.
  3. Deploy the fix provided by Adobe Support to your AEM 6.5.1 environment, following their instructions.
  4. After deploying the fix, monitor the logs to confirm that the handler is now detecting X.509 certificates (look for log entries indicating successful certificate detection via the jakarta.servlet.request.X509Certificate attribute).
  5. If you encounter a KeyStoreNotInitialisedException with a message such as Uninitialised system trust store, update the OSGi configuration for org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended to include com.adobe.granite.auth.cert=truststore-reader-service to add a service user mapping for truststore access.
  6. Restart the affected bundles or the AEM instance, if necessary.
  7. Retest MSSL replication to confirm that client certificate authentication and replication are working as expected.
recommendation-more-help
experience-cloud-kcs-help-kbarticles