SAP Knowledge Base Article - Public

2453212 - Boomi process from SuccessFactors EC to ERP/ECP fail with SunCertPathBuilderException or SSLHandshakeException

Symptom

During execution of standard Boomi iFlows (e.g., EC to EC Payroll – Employee Replication, EC to ERP – Generic Object Replication Handler), Boomi reports SSL/TLS errors such as:

  • SunCertPathBuilderException: unable to find valid certification path to requested target
  • javax.net.ssl.SSLHandshakeException ... PKIX path building failed ... unable to find valid certification path

Environment

  • SAP SuccessFactors HCM Suite
  • Boomi
  • EC Payroll
  • ERP HCM

Reproducing the Issue

These errors typically appear in Boomi > Manage > Process Reporting for the process execution:

01.png

Cause

What this error means

Boomi is acting as the TLS client and SAP ERP is the TLS server.

This error indicates: Boomi cannot validate (trust) the HTTPS certificate presented by the SAP ERP endpoint.

In other words, Boomi cannot build a valid certificate chain from the ERP server certificate to a trusted root Certificate Authority (CA).

This is a client-side trust issue on the Boomi side (or a certificate-chain issue on the ERP side). It is not typically caused by ERP “requiring” a certificate from Boomi (unless mutual TLS is intentionally configured, which is not common).

         

Cause

The issue usually occurs when one or more of the following is true:

  1. ERP uses a self-signed certificate, so Boomi does not trust it by default.
  2. ERP presents an incomplete certificate chain (missing intermediate CA certificates).
  3. ERP’s certificate is issued by a CA that is not trusted in the Boomi runtime trust store (less common).

    

Resolution

Option 1: Import and trust the self-signed or non-public ERP certificate in Boomi

Use this if your ERP endpoint uses a self-signed certificate or a certificate signed by a private/internal CA not trusted by Boomi.

Step A — Export the certificate from the ERP endpoint

Obtain the ERP server certificate (public certificate).
You may also need to export the full chain (server + intermediates).

02.png

Step B — Upload the certificate to Boomi

  1. In Boomi AtomSphere, go to the Build tab.
  2. Create or upload a Certificate component (public certificate).
  3. Save the component.
    03.png

Step C — Deploy the certificate to the Atom runtime

  1. Go to Deploy.
  2. Deploy the certificate component to the Atom (or Molecule/Cloud runtime).
  3. Verify it appears under: Manage > Atom Management > [Atom] > Certificates
    04.png

Step D — Bind the certificate to the connection (“Trust SSL Server Certificate”)

  1. Go to Environment Extensions.
  2. Filter to the affected process.
  3. Open the relevant Connection (SOAP Client connection to ERP).
  4. In the connection settings, set Trust SSL Server Certificate to the uploaded certificate.
  5. Save and redeploy the process if required.

    Result: Boomi will trust that ERP endpoint certificate and the SSL handshake should succeed.

          

             

Option 2: Use a publicly trusted CA-signed certificate on ERP

Use this if you can configure ERP to use a certificate signed by a public root CA that is already trusted by Boomi.

  1. Obtain a certificate for the ERP endpoint signed by a public CA.
  2. Configure ERP (ICM / STRUST / Server PSE depending on setup) to present the certificate and include the full chain (server + intermediates).

    Result: In most cases, no certificate import into Boomi is required, because Boomi runtimes typically trust common public root CAs automatically.

    05.png

       

Important Notes

  • Do not upload private keys to Boomi. Only upload public certificates (server cert and/or CA chain).
  • If you still get the error after importing the server cert:
    • ERP may be sending an incomplete chain (missing intermediate CA).
      In that case, import the intermediate CA certificate(s) as well or fix the chain on the ERP side.
  • Other SSLHandshakeException causes (less common but possible):
    • expired certificate
    • hostname mismatch (certificate CN/SAN does not match the URL)
    • unsupported TLS version/cipher mismatch (depends on runtime and server configuration)

Keywords

ValidatorException, PKIX path building failed, SSLHandshakeException, SunCertPathBuilderException, unable to find valid certification path to requested target, Certificate, Certificate Authority, SuccessFactors, Boomi, Employee Central, EC Payroll, ECP, SAP ERP On premise, SSL, handshake , KBA , LOD-SF-INT-BPI , Dell & Boomi Infrastructure , Problem

Product

SAP SuccessFactors HCM Suite all versions