Junos Space platform certificate expiry causes error: PKIX path validation failed.

Junos space GUI is not initializing after a reboot(PKI certificate expired)

Junos Space GUI is stuck in the start-up screen due to an expired PKI certificate.

There are multiple reasons why a WebUI couldn't be loading, however, we'll discuss how to deal with an expired PKI certificate which may cause this problem.


In the /var/log/jboss/servers/server1/server.log we could see the below error:

Caused by: java.security.cert.CertificateException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
    at net.juniper.jmp.cmp.nma.ReloadableX509TrustManager.checkServerTrusted(ReloadableX509TrustManager.java:120) [jmpsubsystem.jar:]
    at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1297) [jsse.jar:1.8.0_402]
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638) [jsse.jar:1.8.0_402]
    ... 193 more
2024-10-11 16:27:20,658 ERROR [net.juniper.jmp.cmp.resourceDistributionManager.ejb.FabricHealthReportUtil] (EJB ts-pool - 6) javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed

a. Check if the certificate is expired, it needs to be in the past:

openssl x509 -text -in /etc/pki/tls/certs/localhost.crt | grep After
    Not After : Sep 6 22:49:26 2024 GMT

Continue ONLY if the date seen is in the past.  If the date listed is future (for all space nodes) You have encountered a different problem.

b. Stop services:

service jmp-watchdog stop; service jboss stop; service jboss-dc stop; service nma stop

c. Regenerate key/crt:

cp /etc/pki/tls/private/localhost.key /home/admin/localhost.key.old
cp /etc/pki/tls/certs/localhost.crt /home/admin/localhost.crt.old
rm -f /etc/pki/tls/private/localhost.key
rm -f /etc/pki/tls/certs/localhost.crt

d. Find the eth0 IP(Remember to use the eth0 and not the eth0:0 interface):

ip address

e. Update eth0 IP in the next line "IP-address" with the output below:

eth0IP="IP-address"; sh /usr/libexec/jmp-vip-tools/mkClusterCert.sh $eth0IP localhost

f. Start services:

service jmp-watchdog start

2026-01-27 - Simplified instructions for this error, removed notes about checks or changes to other certificates are not related.