Transmission Errors: Error during certificate path validation: No trusted certs found

[AshleyJamesy]

I'm not able to send documents

I'm currently using G3 certificate

My truststore contains all necessary certificates for PKI migration (G2 & G3) from here: https://openpeppol.atlassian.net/wiki/spaces/OPMA/pages/4344053761/Peppol+PKI+2025+-+Certificate+Authorities?atlOrigin=eyJpIjoiZTQ3YzAwZGQxZjZlNGQxZmI3YTBiNGUxM2NhY2Y2YTIiLCJwIjoiYyJ9

2026-03-19 12:19:26,862 DEBUG [org.apache.cxf.phase.PhaseInterceptorChain] Invoking handleMessage on interceptor org.apache.cxf.interceptor.StaxInEndingInterceptor@ba089a6
2026-03-19 12:19:26,862 DEBUG [org.apache.cxf.phase.PhaseInterceptorChain] Invoking handleMessage on interceptor org.apache.cxf.jaxws.interceptors.SwAInInterceptor@46f8c194
2026-03-19 12:19:26,862 DEBUG [org.apache.cxf.phase.PhaseInterceptorChain] Invoking handleMessage on interceptor org.apache.cxf.jaxws.interceptors.HolderInInterceptor@1286eb4f
2026-03-19 12:19:26,862 DEBUG [org.apache.cxf.phase.PhaseInterceptorChain] Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyVerificationInInterceptor@1a0e0ab6
2026-03-19 12:19:26,863 DEBUG [org.apache.cxf.ws.policy.PolicyVerificationInInterceptor] Verified policies for inbound message.
2026-03-19 12:19:26,868 INFO [org.ehcache.core.EhcacheManager] Cache 'org.apache.cxf.ws.security.tokenstore.TokenStore-1783979624' removed from EhcacheManager.
2026-03-19 12:19:26,886 ERROR [network.oxalis.ng.Main] Execution failed: network.oxalis.ng.as4.lang.OxalisAs4TransmissionException: Failed to send message
java.util.concurrent.ExecutionException: network.oxalis.ng.as4.lang.OxalisAs4TransmissionException: Failed to send message
        at java.base/java.util.concurrent.FutureTask.report(Unknown Source)
        at java.base/java.util.concurrent.FutureTask.get(Unknown Source)
        at network.oxalis.ng.Main.main(Main.java:228)
Caused by: network.oxalis.ng.as4.lang.OxalisAs4TransmissionException: Failed to send message
        at network.oxalis.ng.as4.outbound.As4MessageSender.invoke(As4MessageSender.java:108)
        at network.oxalis.ng.as4.outbound.As4MessageSender.send(As4MessageSender.java:89)
        at network.oxalis.ng.as4.outbound.As4MessageSenderFacade.send(As4MessageSenderFacade.java:20)
        at network.oxalis.ng.outbound.transmission.DefaultTransmitter.sendMessage(DefaultTransmitter.java:162)
        at network.oxalis.ng.outbound.transmission.DefaultTransmitter.perform(DefaultTransmitter.java:122)
        at network.oxalis.ng.outbound.transmission.DefaultTransmitter.transmit(DefaultTransmitter.java:96)
        at network.oxalis.ng.TransmissionTask.performTransmission(TransmissionTask.java:157)
        at network.oxalis.ng.TransmissionTask.call(TransmissionTask.java:90)
        at network.oxalis.ng.TransmissionTask.call(TransmissionTask.java:52)
        at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
        at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
        at java.base/java.lang.Thread.run(Unknown Source)
Caused by: network.oxalis.ng.as4.lang.OxalisAs4TransmissionException: Error processing the WSSecurity Header (WS Security error: FAILURE): Technical details: org.apache.wss4j.common.ext.WSSecurityException - Error during certificate path validation: No trusted certs found
        at network.oxalis.ng.as4.outbound.TransmissionResponseConverter.convert(TransmissionResponseConverter.java:56)
        at network.oxalis.ng.as4.outbound.As4MessageSender.invoke(As4MessageSender.java:106)
        ... 14 common frames omitted
Total time spent: 9s
Attempted to send 0 files
Failed transmissions: 1

Looks like this is a response I'm getting from the receiver, so it seems to me the receivers truststore is not setup correctly to trust the new G3 certificates. Is this correct?

[aaron-kumar]

Yes, the error clearly indicates that the receiving AP does not support G3 certificates. If you encounter the error "Error during certificate path validation: No trusted certs found", it signifies that the receiving AP does not trust the presented certificate. Given that you are using a G3 certificate, this suggests that the receiving AP lacks support for G3. The receiving AP MUST support both G2 and G3 certificates.

[AshleyJamesy]

I'm trying to send the mandatory EUSR and TSR to 9925:be0848934496 and am still getting this error. I can see same error when Access Point attempts to receive anything - I assume this is because our Access Point is trying to send a receipt to the sender and fails with the same message

[AshleyJamesy]

@aaron-kumar Would this still be an issue with the receiver? https://peppol.helger.com/public/locale-en_US/menuitem-tools-participant?scheme=iso6523-actorid-upis&value=9925%3Abe0848934496&sml=autodetect&querybc=yes&xsdvalidation=yes&verifysignatures=yes&action=perform

@phax

[phax]

Yes it is an issue at OpenPeppol side. They only accept reports with G2 certs atm :-(

[AshleyJamesy]

They updated it just now, and I've verified it's working. All fixed

[aaron-kumar]

@AshleyJamesy, found that Philip (@phax) already replied- "Yes it is an issue at OpenPeppol side. They only accept reports with G2 certs atm" and you just confirmed that it is working fine.

It is somewhat surprising that G3 had not been supported by OpenPeppol (Reporting) until today, considering that Access Points began adopting G3 certificates from 6th March. This situation can understandably lead to confusion, as illustrated in this case, where the user had to spend a significant amount of time investigating the issue.

For reference, and for others who may encounter similar certificate-related issues, it is recommended to verify whether the problem could be caused by one of the following issue at your/ sending AP side once Receiving AP side confirmed that they support dual certificate:

• Misconfigured signing certificate or incomplete certificate chain
• Broken or modified truststore (especially if default Oxalis-NG truststore has been altered, which supports both G2 and G3 certificates)
• Older Oxalis version without proper PKI G3 / dual certificate support (Use Oxalis-NG 1.2.0 or higher)

Investigation Steps:

1. Oxalis-NG version: Oxalis-NG 1.2.0 or higher support PKI G3 / dual certificate
2. Truststore usage
   • Are you using the default truststore provided by Oxalis-NG?
   • If modified or replaced, please share details of the changes and related configuration. Though it is recommended, Not alter anything. Oxalis-NG come preconfigured with Truststore
3. Keystore configuration
   Minimum required configuration in oxalis.conf related to certificate is typically

   oxalis.keystore {
              path = "C:/PFIxxxxxx_AP.p12"
              password = "XXXXXXXXXXX"
              key.alias = "<alias as defined in the .p12 certificate>"
              key.password = "XXXXXXXXX"
    }
   

   In a standard setup, Oxalis handles the remaining certificate and trust configuration automatically.
4. Signing certificate and full chain
   Please verify using Keystore Explorer or:
   keytool -list -v -keystore yourfile.p12 -storetype PKCS12
   Check that:
   • Keystore contains a PrivateKeyEntry with a certificate chain
   • Alias used matches the one configured in oxalis.conf
   • Certificate chain is complete (3 certificates):
     • Certificate [1]: Your AP certificate (issued by PEPPOL Access Point CA - G3)
     • Certificate [2]: PEPPOL Access Point CA - G3 (intermediate)
     • Certificate [3]: PEPPOL Root CA - G3 (root)
       Note: If the certificate was obtained via Web-Based Enrolment, P12 file contains the private key along with the complete certificate chain in the correct order, unless it has been modified afterward.
       If the certificate was generated using CSR-based enrolment, please ensure that the process was completed correctly and that the resulting P12 includes the full and properly ordered certificate chain (including intermediate certificates).
       Kindly verify the details against the instructions provided above.
5. Debug logs
   If everything above looks correct, please share detailed DEBUG logs.

[runekock]

Also, remember that there are different test and production certificates.

[AshleyJamesy]

Yes, I'm using the G3 production certificates as per T1 migration

[runekock]

It sounds like you have added to the trust store yourself. Why? The current version of Oxalis comes with the correct truststore already.

[AshleyJamesy]

Because I was getting this error and trying to identify the issue, I've tried with the default truststore also

[runekock]

Any special settings in oxalis.conf?

[AshleyJamesy]

Nope. As soon as I upgraded to G3 certificate, it stopped working