After upgrading the FMS (Foglight Management Server) users are unable to login with LDAPS authentication.
With debug logging enabled, the error below is noted:
DEBUG [http-exec-1] com.quest.nitro.service.security.auth.spi.NitroExtendedLdapLoginModule - Error connecting to LDAP server: ldaps://hostname.yourdomain.com:636/
javax.naming.CommunicationException: simple bind failed: 192.168.100.50:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
After an FMS upgrade the JRE (Java Runtime Environment) may get updated to a newer version, which includes a potentially updated default cacerts (CA certificate store) file. The SSL certificate issuer of the LDAP server is not in the new default cacerts file.
After an FMS upgrade, the previous cacerts file is retained in the $FGLHOME/state/backup/[previous Foglight version]/jre/lib/security directory.
To restore any custom certificates, replace the cacerts file in $FGLHOME/jre/lib/security with the backed up version found under the state backup directory.
In the following example, the file to be replaced is in the $FGLHOME/jre/lib/security directory.
Directory of: $FGLHOME/state/backup/[previous Foglight version]/jre/lib/security
rw- 113 KB 2017-09-24 08:46 cacerts
Directory of: $FGLHOME/jre/lib/security
rwx 113 KB 2018-02-27 17:10 cacerts
Foglight also support a separate TrustStore, which will be preserved during upgrade. For more information refer to KB 4254139.