Archimate CoArchi SSL issue

[kkosienski]

Looking for help resolving an issue with the COArchi plugin install on a Windows 10 device. When trying to do an initial import of a model from a git repository I am getting the following error? Using a vanilla install of Archimate (4.5.1) and the CoArchi plugin.

[jbsarrodie]

This is most certainly related to one missing certificate in your truststore. See this wiki page: https://github.com/archimatetool/archi-modelrepository-plugin/wiki/Use-SSL-TLS-with-local-or-private-PKI

[kkosienski]

Thanks for the quick response and info. I followed the procedure to make Archi use OS certificate. Attached the Archi.ini after modifying. I restarted my laptop and tried again and received the same message.

-clean
--launcher.defaultAction
openFile
-vmargs
-Djavax.net.ssl.trustStore=NUL
-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT
-Dosgi.requiredJavaVersion=1.8
[email protected]/AppData/Roaming/Archi4
[email protected]/AppData/Roaming/Archi4/.config
-Dorg.eclipse.equinox.p2.reconciler.dropins.directory=%user.home%/AppData/Roaming/Archi4/dropins
--add-modules=ALL-SYSTEM

I was going to try the other procedure but I am not sure what certificates should be exported from windows cert repository and imported into CACERTS used by the JRE Archi is using?

[jbsarrodie]

I followed the procedure to make Archi use OS certificate. Attached the Archi.ini after modifying. I restarted my laptop and tried again and received the same message.

The options to use a WINDOWS-ROOT trustStoreType have been provided by users on the forum:

• https://forum.archimatetool.com/index.php?topic=747.msg4213#msg4213
• https://forum.archimatetool.com/index.php?topic=660.msg3679#msg3679
• https://forum.archimatetool.com/index.php?topic=725.msg4096#msg4096

I did test recently (windows 2010) and was not able to make it work, and thus went the cacert way (which I have been using for several years).

I think we should go back to the forum (the first thred listed is the more recent) and see if someone can help you (and me) on this.

I was going to try the other procedure but I am not sure what certificates should be exported from windows cert repository and imported into CACERTS used by the JRE Archi is using.

Usually you can simply connect to you git server in a browser and look at the certificate chain. Another option is to ask your IT guys which certificates are deployed on your workstation and needed for this server.

[kkosienski]

I appreciate the help and for the lead on the additional discussion topics in the archimate forum. I will check out those topics.

[Plepoutre2019]

I had the same problem here migrating from archi 4.4 to archi 4.6
I have both versions installed (portable version), archi 4.4 still works fine, archi 4.6 displayed this error on import or refresh

Problem was that I did forget

• to update cacerts file in archi\jre\lib\security with our own made-up file
• and then do a archi\jre\bin\keytool -list -keystore cacerts

now it works fine.

[morb-au]

This is most certainly related to one missing certificate in your truststore. See this wiki page: https://github.com/archimatetool/archi-modelrepository-plugin/wiki/Use-SSL-TLS-with-local-or-private-PKI

Hi JB,

Can confirm that the following additions to Archi.ini seem to work great in my corporate network environment and Windows 10, thank you! I use this to reach out to a coArchi remote repository on dev.azure.com (Azure DevOps Repos) across our corporate proxy/firewall:

-Djavax.net.ssl.trustStore=NUL
-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT

I'd even go so far as to recommend (or at least cast my vote that) these become the default Archi.ini options in your Windows build, if that's possible?

This would follow the way (for example) web browsers seem to determine Trusted Root Certification Authorities on Windows, and therefore allow a single point of management for trusted root CAs on each corporate Windows machine, rather than also having to manage the various ..\jre\lib\security\cacerts files around the place. (such as C:\Program Files\Archi4\jre\lib\security\cacerts)

Thanks,
Brendan

[Plepoutre2019]

one last thing that may cause problem : if you changed your password and asked component to store it locally

[pchar]

I've writen a path that allow to skip the SSL verfiction
#164