Mid Servers Down - Session contains no certificates

[Kai Tingey]

Hi All

We have upgraded our Dev and Test environments to Quebec and the mid servers have fallen over. After trying a number of things to revive them (after upgrading them) I have chosen to reinstall them. 

After installing and setting them up, I exported the certificate from our instance and imported it into the java keystore in the mid server folder (agent\jre\lib\security\cacerts) for all the mid servers.  The mid servers then were able to talk to the instance and I was able to validate them. They seemed happy and were ok.

This morning I have checked again and all four mid servers (two for dev, two for test) are now down and the log files all tell me the same thing:

03/16/21 09:44:16 (854) ECCSender.1 WARNING *** WARNING *** org.apache.commons.httpclient.HttpException: Session contains no certificates - Untrusted

Nothing has changed from yesterday.

This was an issue the other day also. We upgraded DEV to Quebec first, and i updated the mid servers and had the same issue. After re-importing the certificate it was good, until i checked again after we upgraded TEST. I noticed they were down with this error so I just reinstalled all four mid servers.

Any suggestions as to why this is happening? the certificate is definitely valid and the one i imported was taken from an export yesterday so it shouldn't be out of date or anything like that. 

Thankfully prod is still up and running as we are working through the upgrade in our sub-production instances first, but I definitely need to know what is causing this problem before we think about going ahead with a production upgrade.

[Saikiran Guduri]

Hi Kai,

This may help : https://community.servicenow.com/community?id=community_question&sys_id=074a4a7fdb432410fb4ae15b8a96...

Thanks,

Saikiran

[Kai Tingey · Accepted solution]

^ the above does work as a workaround. However our security team did not want to implement that solution.

We got this resolved with the help of HI support.

Basically we had to import the entire certificate chain into the JRE keystore (comprising 4 certs), rather than just the *.servicenow one (which we have been able to get away with in the past).

it's now resolved.