secstorage.proxy AFTER PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException

[Ecsi1337]

I installed cloudstack on an internal local network because I'm getting to know it. So far, I don't like how complicated it is to set up. It's all been a bit of a nightmare so far...
This is where my original problems come from:

#11829

In one of the comments, I got the
" secstorage.proxy " setting to set up the local proxy so I could download the templates. I set /etc/environment on the host, on the management server and on the SSVM to no avail.
But since then, since I set up secstorage.proxy, I've been getting this:

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

And two more questions, can someone please tell me how to set up iscsi properly, and how to add a second network card to the VM afterwards.

Thanks in advance!

[prashanthr2]

@Ecsi1337

>>But since then, since I set up secstorage.proxy, I've been getting this:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Above is clearly an SSL cert issue. Are you using self-signed certs on your proxy or webserver hosting the templates? Unless the certs are not trusted you will see this issue. Setup your proxy or webserver hosting the templates with http , this will avoid the above issue.

[Ecsi1337]

@prashanthr2
I'll set up everything I can, if I knew how to do it.
There's a local proxy that the machines and servers connect to, and they access the internet via the address 192.168.100.100:3128. So what and where should I set it up?

The iscsi and the 2nd network card are still a question.

[prashanthr2]

@Ecsi1337 based on the error you shared, it appears that the proxy is performing SSL termination. The certificate presented by the proxy to the SSVM is not trusted, which is causing the error. To resolve this, ensure that the proxy presents a valid/trusted public certificate or disable SSL termination on your proxy or configure the web server behind the proxy to use HTTP instead of HTTPS.

ISCSI query:
For KVM, iSCSI isn’t directly supported as a primary storage type, it can only be used through the SharedMountPoint option see https://docs.cloudstack.apache.org/en/latest/adminguide/storage.html#hypervisor-support-for-primary-storage

So, you’ll need to set up and mount the iSCSI block device manually on each KVM host (outside of CloudStack), making sure the mount path is the same across all hosts. Once that’s done, you can add it as Primary Storage in CloudStack using the SharedMountPoint path. The steps to configure iSCSI itself are specific to your KVM host OS, so I’d recommend checking your distribution’s documentation for the correct setup procedure.

2nd Network query:
The steps to add additional networks to the VM are detailed here in the docs https://docs.cloudstack.apache.org/en/latest/adminguide/networking/multiple_guest_networks.html

[Ecsi1337]

Where can I temporarily set it or what settings can I use to make cloudstack-management communicate and download templates over http, not https? I tried disabling the "redfish.use.https" setting, but it didn't solve the problem.

[rajujith]

If you are registering the template with URL , just use the HTTP URL. If you are using local upload, set 'use.https.to.upload' to 'false'.

[Ecsi1337]

Unfortunately, I solved it by modifying the proxy. It's a shame that it has to be so complicated.

[Ecsi1337]

Is there anything in this system that works right away without error?

[Ecsi1337]

@prashanthr2
To make it easier to find, look for the gist in the diary between 12:29 and 12:31.
management-server.log

[prashanthr2]

@Ecsi1337 VM deployment is failing as connection to the VR is failing as below

2025-10-16 12:30:02,676 DEBUG [c.c.a.t.Request] (AgentManager-Handler-2:[ctx-6331e934]) (logid:) Seq 1-2640798231499375788: Processing: { Ans: , MgmtId: 95035123761157, via: 1, Ver: v1, Flags: 10, [{"com.cloud.agent.api.routing.GroupAnswer":{"results":["null - failed: There was a problem while connecting to 169.254.10.125:3922","null - failed: java.io.IOException: Stream closed
at java.base/java.io.BufferedInputStream.getBufIfOpen(BufferedInputStream.java:168)
at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:334)

We see health checks failing on the VR as well

2025-10-16 12:25:50,069 DEBUG [c.c.n.r.V.UpdateRouterHealthChecksConfigTask] (RouterStatusMonitor-1:[ctx-2cd94fd2]) (logid:a5c22ae6) Couldn't update health checks config on router: VM instance {"id":8,"instanceName":"r-8-VM","state":"Running","type":"DomainRouter","uuid":"5bc3c7a9-8065-4bee-9eab-99b4612511bc"} as basic tests didn't succeed, java.io.IOException: Stream closed
at java.base/java.io.BufferedInputStream.getBufIfOpen(BufferedInputStream.java:168)

Ideally you should be able to ssh into the VR from the KVM host ( where the VR is running ) using the instructions here https://docs.cloudstack.apache.org/en/latest/adminguide/systemvm.html#accessing-system-vms . This seems to be failing in your environment and it can be either due to some issue with the VR itself or the systemVM template.

Next Steps:
To proceed further, Destroy the VR in the network used for the VM or restart the network with cleanup=true ( this will destroy and recreate the VR). Once done, deploy the VM again and see how it goes.

[Ecsi1337]

@prashanthr2

"restart the network with cleanup=true"

How to do this? Could you explain, I'm quite familiar with it, but nothing is ever as complicated as it is here in other hypervisors. Even the basic things.
Thank you for your help

[Ecsi1337]

@prashanthr2
I pressed destroy on the only virtual router but it didn't re-create automatically. And I don't know how to set "cleanup=true".

[SviridoffA]

@Ecsi1337

[weizhouapache]

@Ecsi1337
does the issue still exist ?