SSL Errors - Unable to get local issuer certificate

When the error 'Unable to get local issuer certificate' is seen, it normally indicates one of the following:

• The certificate of the URL accessed is not present in the JRE/JDK keystore.
  
• The incorrect JRE/JDK is being used. 
  
• The configuration is pointing to the wrong keystore. 

The error can be seen in the log.

Sample log is shows below:

To find the AIP Logs please refer CAST Management Studio - Information - How to find logs 

1. Encountered error in log.

1. To resolve the issue that occurs because the certificate of the site is not imported into the JRE/JDK used, then follow the steps in this page: SSL Errors - PXIX path building failed - How to import certificate into JRE/JDK  to import the certificate.
   
2. Check your JDK/JRE version and make sure it is one supported by CAST.  If you need to install a new version then (the steps below show specific details for console, but similar steps would need to be done on other CAST products):
   1. Install your JDK
   2. Update the JAVA_HOME environment variable to the newly installed jdk
   3. Please stop and then uninstall the console and node service (running uninstall-service.bat)
      1. Remove the Windows Service by running the following batch file depending on your deployment mode: 
         • %PROGRAMFILES%\CAST\AipConsole\AipNode\tools\aip-node-service-uninstall.bat
%PROGRAMFILES%\CAST\AipConsole\AipConsole\tools\aip-console-service-uninstall.bat
   4. Now make sure that the console and node service bat files are pointing to the correct new jdk path (verify this by opening the install service bat file in notepad - see step E for paths if needed):
      
      1. Should be something like this:
      2. 
   5. Install the console and node service
      1. Manually install the Windows Service using the following batch files:

         1. %PROGRAMFILES%\CAST\AipConsole\AipNode\tools\aip-node-service-install.bat
%PROGRAMFILES%\CAST\AipConsole\AipConsole\tools\aip-console-service-install.bat

   6. Import the certificate in to the new jdk keystore
   7. Try to reproduce
3. Check your configuration and make sure that you have the proper keystore configured and are using the correct keystore location for the CAST application you are using.

If the above steps do not solve your issue contact CAST Technical Support. with the following Relevant input

Relevant input

• Log file showing the error
• A detailed list of the steps done
• Screenshots from part of AIP showing the issue 

Ticket # 28606