Akamai origin certificate mismatch causes SSL handshake failure in AEM
This article explains how to resolve SSL handshake failures that occur when Akamai cannot establish a secure connection to an Adobe Experience Manager (AEM) environment due to a mismatch between the certificate’s Common Name (CN) or Subject Alternative Name (SAN) and the values configured in Akamai.
Description description
Environment
Adobe Experience Manager (AEM) integrated with Akamai, typically with an AWS Application Load Balancer (ALB) as the origin server.
Symptoms
SSL handshake failures occur when Akamai attempts to connect to the AEM origin server, resulting in errors related to CN/SAN mismatches. Users are unable to access AEM sites through Akamai.
Cause
Akamai is configured to allow only specific CN or SAN values for origin certificates. If the certificate presented by the AEM origin server does not match these values, the SSL handshake fails.
Resolution resolution
Follow the steps below to resolve the issue:
- Identify the required CN and SAN values for the AEM domains configured in Akamai. Include all domains that Akamai expects to find in the origin certificate.
- Obtain or generate an SSL certificate, private key, and certificate chain that include all required domains in the CN or SAN entries. Reuse an existing certificate if it already covers all required domains.
- Upload the SSL certificate, private key, and certificate chain to the AWS Application Load Balancer (ALB) or the relevant origin server that handles AEM traffic.
- Replace any existing certificate on the ALB that does not include the required CN or SAN values with the new or updated certificate.
- Access the AEM domains through Akamai and verify that the SSL handshake completes successfully.
- Review the Akamai logs or use an SSL testing tool to verify that the presented certificate contains the expected CN and SAN values and that the certificate-related error no longer occurs.
- If necessary, work with the Akamai team and relevant internal stakeholders to confirm the configuration and validate the results.