No trusted certificate when running notes java agent from server

Question

I have a Java agent which is doing a HTTPS POST:

            URL url = new URL("https://postman-echo.com/post");
            HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
            SSLContext sc = SSLContext.getInstance("TLSv1.2");
            sc.init(null, null, new java.security.SecureRandom());
            conn.setSSLSocketFactory(sc.getSocketFactory());
            conn.setRequestMethod("POST");
            conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
            conn.setRequestProperty("Content-Length", String.valueOf(postDataBytes.length));
            conn.setDoOutput(true);
            conn.getOutputStream().write(postDataBytes);
            //Reader in = new BufferedReader(new InputStreamReader(conn.getInputStream(), "UTF-8"));

            System.out.println("RESPONSE : "  + conn.getResponseMessage());
            return conn.getResponseMessage();

This POST works when running the agent on the server manually. If I am posting the agent scheduled or via the console by : tell amgr run Then I am getting this error:

error message: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: No trusted certificate found

I truly have no idea why this is the case. Its running the agent with: 1. Target set to None 2. running with administrator ID 3. Security Allow restricted operations with full administration rights

It worked last week and now not anymore..

Update When doing a post to: https://postman-echo.com/post it works, also when running from server. When doing post to my own website which has a comodo extended validation ssl then I get the no trusted certificate error

Solution I have updated the Server from 9.0.1 FP4 to 9.0.1 FP10. It now posts data (from scheduled agent) to the HTTPS address without getting the error.

What version of domino are you running? Have you read this technote? www-01.ibm.com/support/docview.wss?uid=swg21985289 — Richard Schwartz
It is fixed. I have updated the Server from 9.0.1 FP4 to 9.0.1 FP10. Thanks ! — YdB

Michael Ruhnau Michael Ruhnau · Accepted Answer · 2019-05-02T13:25:10

Your java agent runs inside the JRE implemented in domino. As you are connecting via https you have to import the ssl certificate of the requested site to the truststore (cacert file) of the JRE. Otherwise the ssl handshake fails. The location of the JRE on the server is /jvm/lib/security .

No trusted certificate when running notes java agent from server

1 Answers