This is an appropriate corrective action for a PKIX certification-path failure. When the Active Directory connector communicates with a domain controller using TLS, the Virtual Appliance must trust the certificate presented by that server. A PKIX path validation failed or unable to find valid certification path to requested target error indicates that Java cannot construct a trusted certificate chain from the server certificate to a trusted certification authority.

Consequently, verifying that the correct CA or server certificate is available to the VA is a fundamental troubleshooting step. SailPoint supports TLS between Virtual Appliances and compatible sources and documents certificate management on the VA for situations where trusted certificates need to be added manually. Current configuration also attempts to copy supported TLS certificates automatically to the VA cluster, but administrators must still validate certificate trust when TLS handshakes fail.

The certificate chain, expiration, hostname, and issuing CA should also be checked. Once the VA trusts the appropriate chain, the TLS handshake can complete successfully.

Study Guide Reference: Virtual Appliances — TLS Configuration, Certificate Trust, Active Directory Secure Connectivity and PKIX Troubleshooting.

===============