PKIX path building failed

Had a running Jitsi meet on: Centos 7 nginx 1.12.2 prosody 0.10.0 java version "1.8.0_77" using a Let’s encrypt certificate

with the jitsi versions: Jitsi Meet jitsi-meet_2514 Jicofo jitsi-meet_2514 Videobridge 997

After updating it to: Jitsi Meet jitsi-meet_2971 Jicofo jitsi-meet_2971 Videobridge 1053

I get this error:

jicofo.sh[4072]: Jicofo 2018-04-19 13:39:03.931 SEVERE: [108] org.jitsi.impl.protocol.xmpp.XmppProtocolProvider.doConnect().345 Failed to connect/login: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
jicofo.sh[4072]: org.jivesoftware.smack.SmackException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.parsePackets(XMPPTCPConnection.java:1060)
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.access$300(XMPPTCPConnection.java:982)
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader$1.run(XMPPTCPConnection.java:998)
jicofo.sh[4072]: at java.lang.Thread.run(Thread.java:745)
jicofo.sh[4072]: Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
jicofo.sh[4072]: at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
jicofo.sh[4072]: at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
jicofo.sh[4072]: at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
jicofo.sh[4072]: at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
jicofo.sh[4072]: at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
jicofo.sh[4072]: at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
jicofo.sh[4072]: at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
jicofo.sh[4072]: at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
jicofo.sh[4072]: at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
jicofo.sh[4072]: at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
jicofo.sh[4072]: at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
jicofo.sh[4072]: at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection.proceedTLSReceived(XMPPTCPConnection.java:798)
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection.access$1200(XMPPTCPConnection.java:150)
jicofo.sh[4072]: at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.parsePackets(XMPPTCPConnection.java:1055)

...

I’ve seen that there are already some issues in here with the same error. But as I’m on centos I’m not able to e.g. delete everything and use the automatic Debian installation script.

1. Was there a change somewhere between these two versions mentioned above, which could cause this issue?
2. How can I manually solve this on centos?

[mwild1]

Just a note for anyone who may stumble upon this previous comment, the correct way to use ‘cert import’ is actually to pass it a directory. Passing it the path to fullchain.pem will cause it to incorrectly use this as the key also.

So:

prosodyctl --root cert import jitsi.mydomain.com /etc/letsencrypt/live

Prosody will find the fullchain.pem and privkey.pem itself.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.