Problem Description
I want to connect to a server in COMSOL Multiphysics using a secure connection, for example connecting to a Model Manager server database or sending requests to a web server using HTTPS from method code, but I get an error message "unable to find valid certification path to requested target".
Solution
The error message means that the Java runtime of COMSOL Multiphysics does not trust the server certificate. Follow the instructions below, based on the operating system that COMSOL Multiphysics is installed for, to ensure that the server certificate is trusted.
Alternatively, contact the server administrator to request that the server certificate includes a trust chain to a public certificate authority (CA). Then the Java runtime will most likely trust it already.
Trusting server certificates
You will first need to determine the root of the certificate chain of the server, which will typically be a local CA certificate of your organization. If you don't already have it available as a file, see Retrieving the certificate chain of the server below.
The certificate to trust can be put in any temporary location on the computer that runs the Model Manager server. After the certificate has been imported into the trust store, as described below, the certificate file is no longer used and can be removed from the temporary location.
On Windows (with COMSOL version 6.2 and above)
Starting with version 6.2, COMSOL Multiphysics uses the built-in trust store of the Windows operating system so all you have to do is to import the root certificate into the Windows trust store.
- Launch the built-in
certlm.msc
tool in Windows and navigate to the Trusted Root Certification Authorities > Certificates folder. - From the Action menu, choose Import and click Next to specify the file to import.
- Click Browse or type the path to the certificate to import as a trusted root.
- Click Next, Next and Finish, and verify that the certificate appears in the list.
On Linux® and macOS, or Windows (with COMSOL version 6.1 and below)
On Linux and macOS systems (and prior to COMSOL version 6.1 also on Windows systems), COMSOL Multiphysics uses the trust store that comes with the Java runtime in the installation.
- Find the path to the Java
keytool
that is included in the COMSOL Multiphysics installation.- On Linux systems, the default path is
/usr/local/comsol62/multiphysics/java/glnxa64/jre/bin/keytool
. - On macOS systems, the default path is
/Applications/COMSOL62/Multiphysics/java/maci64/jre/bin/keytool
- On Windows systems, the default path is
C:\Program Files\COMSOL\COMSOL62\Multiphysics\java\win64\jre\bin\keytool.exe
- Replace
glnxa64
andmaci64
withglnxarm64
andmacarm64
, respectively, on ARM64 based platforms.
- On Linux systems, the default path is
- Run
keytool
with arguments-importcert -cacerts -file myrootcert.pem -alias myrootcert
, where the-file
argument should point to the root certificate to import and-alias
is the alias of the imported root certificate entry in the trust store.- You need to run the command with permissions to write to the installation directory.
- The alias used must be unique within the keystore and does not have to match the filename. If you want to import multiple root certificates, pick a different alias for each one.
- Enter the password of the Java
cacerts
file which is by defaultchangeit
. - Review the certificate information and answer
yes
if asked to import it.- If you get the error "Certificate not imported, alias
already exists" the alias was already in use. Pick another alias, or use -delete -cacerts -alias myrootcert
to delete the existing root certificate before importing the new one.
- If you get the error "Certificate not imported, alias
Note: There might be other COMSOL software installed on the system. Take care to locate the COMSOL Multiphysics installation of the version that you use, and run the keytool
from the Java runtime of that installation. Even in the case of connecting to a Model Manager server, it is still the COMSOL Multiphysics side that must trust the server's certificate, so there's no need to perform this operation for the Model Manager server installation.
Retrieving the certificate chain of the server
The Java keytool
is included in the COMSOL Multiphysics installation, at the default paths given above under Trusting server certificates.
- Run
keytool
with arguments-printcert -rfc -sslserver hostname:port
, wherehostname:port
is the hostname and the secure port of the server.- If you get the error "No certificate from the SSL server", check that the hostname is correct and without
https://
prefix and that the port is the secure port and not for example the non-secure HTTP port of the server.
- If you get the error "No certificate from the SSL server", check that the hostname is correct and without
- The output should be blocks start start with
-----BEGIN CERTIFICATE-----
and end with-----END CERTIFICATE-----
. Copy the last such block printed to the clipboard, which should typically correspond to the root of the certificate chain. - Paste the block in a text editor and save the file as
myrootcert.pem
to any temporary location.
Note: You should ensure that your connection to the server is on a trusted network, as you could otherwise in theory retrieve the certificate chain from a malicious party in a man-in-the-middle attack. To reduce the risk of such an attack you should communicate with the server administrator over a trusted channel, after retrieving the certificate chain, to verify the root certificate fingerprint before trusting it.
COMSOL makes every reasonable effort to verify the information you view on this page. Resources and documents are provided for your information only, and COMSOL makes no explicit or implied claims to their validity. COMSOL does not assume any legal liability for the accuracy of the data disclosed. Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark details.