Unable to find valid certification path to requested target

[francescodiperna]

Good morning,
I have installed Phoss using my SMP test certificate e configured with the SMK.
After the registration of a Service group and the relative endpoints I got the following error check by the tool: https://peppol.helger.com/public/locale-en_US/menuitem-tools-participant

Error querying SMP.
Technical details: SMPClientException - Unknown error thrown by SMP server (PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)
Caused by: SSLHandshakeException - PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Caused by: ValidatorException - PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Caused by: SunCertPathBuilderException - unable to find valid certification path to requested target

I do not understand the meaning of this error. Could be related to the certificate inserted in the endopoint configuration? (I have used the test AP certificate).

Kind regards

[phax]

Hi Francesco,
most likely you are using an invalid certificate in your SMP.
Please check, that your Peppol SMP certificate was built using the rules elaborated at https://github.com/phax/phoss-smp/wiki/Certificate-setup#peppol-pki-v3-starting-2018

Did you do that?
// Philip

[phax]

Currently your SMP uses 2 different kind of certificates:

1. The Peppol SMP certificate to sign the payload - this looks okay and this will be trusted
2. The TLS certificate for https - this is some Sectigo certificate that is not trusted, because the SMP connections are not meant to use TLS

Hope that clarifies it

[francescodiperna]

Thanks, I understood. Is not easy to configure this because if I want to use the phoss administration webapp I need to put in HTTPS to avoid browser block.

[phax]

Yep. At https://github.com/phax/phoss-smp/wiki/Security I tried to summarize security related aspects...

[francescodiperna]

Thanks Philips, I think I have found the correct configuration for my AKS ingress-nginx.
All the URL that start with *.acc.edelivery.tech.ec.europa.eu/ will pass via HTTP but the URL *.acc.edelivery.tech.ec.europa.eu/secure will be redirect to our SMP URL via https, as the following examples.
Bye

http://b-7c4205b8f42e26c6cbecb20a34a11213.iso6523-actorid-upis.acc.edelivery.tech.ec.europa.eu/iso6523-actorid-upis::0211:it01928980679

http://b-7c4205b8f42e26c6cbecb20a34a11213.iso6523-actorid-upis.acc.edelivery.tech.ec.europa.eu/secure

[francescodiperna]

I have to verify the URL of the API rest