---
title: SSL or connection errors (Java)
source: https://docs.newrelic.com/docs/apm/agents/java-agent/troubleshooting/ssl-or-connection-errors-java
---

## Problem A: SSL/connection errors in logs [#ssl-error-logs]

Your New Relic Java agent's [log data](https://docs.newrelic.com/docs/agents/java-agent/troubleshooting/generate-debug-logs-troubleshooting-java) shows SSL or connection errors.

> #### 💡 TIP
>
> See [Configuring your SSL certificates](https://docs.newrelic.com/docs/agents/java-agent/configuration/configuring-your-ssl-certificates) for instructions on how to communicate with the New Relic collector over HTTPS.

### Solution A [#ssl-error-logs-solution]

Failures to connect via SSL typically appear early in the Java agent's log files. For example:

```
PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath
```

```
INFO: connection error: java.net.SocketException: java.lang.ClassNotFoundException: 
Cannot find the specified class com.ibm.websphere.ssl.protocol.SSLSocketFactory
```

If you see either of these errors, your JDK instance probably is using a customized trust store.

Recommendation: Add the DigiCert Global Root Certificate Authority (CA), from which New Relic's certificate is derived, to your trust store.

You can download the [DigiCert Global Root CA](https://www.digicert.com/kb/digicert-root-certificates.htm) from DigiCert under the "Other root certificates" section (choose the "Download PEM" option).

To import the cert to your trust store, use this command, or see [Oracle's Java SE documentation for keytool](https://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html):

```sh
keytool -importcert -alias ca_alias -file ca_file.pem -keystore truststore.ts -storepass ts_password
```

Parameters include:

| Parameter       | Description                                                          |
| --------------- | -------------------------------------------------------------------- |
| `ca_alias`      | The alias you want to use in your trust store for the imported cert. |
| `ca_file`       | The file containing the cert you are adding.                         |
| `truststore.ts` | The trust store to which the cert will be added.                     |
| `ts_password`   | The password used by `truststore.ts`.                                |

## Problem B: logs show exception [#log-exception]

Your New Relic Java agent's [log data](https://docs.newrelic.com/docs/agents/java-agent/troubleshooting/generate-debug-logs-troubleshooting-java) shows the following `CertificateException`.

```
java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: Illegal header: -----BEGIN CERTIFICATE-----
```

This is most likely related to this [JDK issue](https://bugs.openjdk.java.net/browse/JDK-8208602).

### Solution B [#log-exception-solution]

Examine and validate that the header and footer of your certificates do not have trailing whitespaces. If they do, edit or use different certificates.