Advanced Event Mesh Adapter - PKIX Path Building Failed During Deployment

Connectors & Integrations
1

Hello Experts,

We are using the Advanced Event Mesh (AEM) Adapter in SAP Integration Suite (Cloud Integration) to connect to a Solace-based event broker using the SMF/JCSMP protocol over TLS.

The adapter configuration includes:

  • SMF/JCSMP endpoint
  • Basic Authentication
  • Secure TLS connection (tcps)
  • Security Material maintained in Cloud Integration

Issue

The integration flow deployment fails with the following error:

ValidatorException: PKIX path building failed

sun.security.provider.certpath.SunCertPathBuilderException:

unable to find valid certification path to requested target

What has already been verified

  1. TLS Connectivity Test from SAP Cloud integration can successfully reach the target host and port.
  2. DNS resolution is working.
  3. Firewall/network connectivity appears to be working.
  4. Required Root CA certificates have been imported into the Cloud Integration Keystore.
  5. Additional corporate CA certificates are already available in the tenant keystore.
  6. The endpoint credentials and VPN configuration have been verified.
  7. Using an internal/private hostname results in:

com.solacesystems.jcsmp.JCSMPTransportException:

Login request timeout

while using the public secure endpoint results in the PKIX error above.

Questions

  1. Has anyone encountered a PKIX error with the Advanced Event Mesh Adapter even when the root certificates already exist in the tenant keystore?
  2. Does the AEM Adapter use the same trust validation mechanism as the standard Cloud Integration TLS Connectivity Test?
  3. Are there known cases where the Solace broker presents an incomplete certificate chain (missing intermediate certificates), resulting in PKIX failures?
  4. Is there a way to determine the exact certificate or trust anchor that Cloud Integration cannot validate during adapter deployment?
  5. Are there any SAP Notes or troubleshooting guides specifically addressing PKIX errors with the Advanced Event Mesh Adapter?

Any guidance or similar experiences would be greatly appreciated.

Thank you in advance…

2

Hi @suresh4u9696m, this is expected behavior rather than a bug in your setup.

With Basic Authentication, the AEM Adapter doesn’t automatically use SAP CPI’s Security Material for TLS trust validation — that’s a separate mechanism from the platform’s TLS Connectivity Test. The certs you imported into the tenant keystore aren’t picked up by the adapter’s JCSMP session unless you explicitly opt in.

Fix: On the adapter’s Connection tab, add this to the JCSMP Properties map:

ADAPTER.CUSTOM_PROP.USE_CPI_TRUSTSTORE = true

(Added in v1.4.1, works for both Sender and Receiver adapters.) This makes the adapter build its TLS trust store from the CA certs already in your tenant’s Security Material — exactly what you’ve already imported — instead of relying on the JVM default trust store.

Let us know how it goes!

Thanks,

Sunil