On Thu, Mar 04, 2021 at 07:32:18AM -0800, Juan López wrote:
> In our Dspace we have configurated office 365 as the smtp server, this
> configuration was working fine last year, but, in 2021 there has been an
> intermittency with dspace sending emails.
>
> From time to time the platform sends the emails just fine, but in other
> ocassions Dspace throws this kinds of errors:
>
> Java stacktrace: sun.security.provider.certpath.SunCertPathBuilderException:
> unable to find valid certification path to requested target at
> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
"Unable to find valid certification path" means that an SSL/TLS
certificate could not be validated because there was no chain of
validations from that certificate to one that your system has been
told to trust.
DSpace was trying to connect securely to the SMTP server, and the SMTP
server presented its certificate, but the root certificate authority
which ultimately certifies the SMTP server's identity is not listed in
your trust store. That is: there is no self-signed certificate from
the root CA in your trust store.
It seems likely that Microsoft have either added new SMTP servers
which use certificates from a newer CA, or have replaced expiring
certificates with new ones from a newer CA.
You need to ensure that your trust store contains all of the root CA
certificates that will be needed to validate certificates from
Office365 SMTP servers. I haven't dealt with Office365, so I don't
know the best way to get the list of needed roots.
Once you have any missing CA certificates, and determined that you
trust them, you need to add them to the trust store. This could vary
from one Java implementation to another and from one OS distribution
to another. The trust store for OpenJDK (and probably for Oracle JDK)
is under the JDK's home directory at 'jre/lib/security/cacerts'.
OpenJDK uses the traditional JKS KeyStore format for the trust store,
so you'd use 'keytool' to add certificates. It's probably best to
consult your distribution's documentation for details.
Now that I've made it sound complicated, it is possible that you just
need to update your JDK to the distribution's latest patchlevel.
--
Mark H. Wood
Lead Technology Analyst
University Library
Indiana University - Purdue University Indianapolis
755 W. Michigan Street
Indianapolis, IN 46202
317-274-0749
www.ulib.iupui.edu