Two recently reported issues exhibited the same symptom and there were two resolutions that worked:

1. Remove or update the old SSL Certs .crt and .key, and restart the containers.

2. Specify a different hostname for FME Server using EXTERNALHOSTNAME when starting building or starting the containers – suggested to try using an IP Address.

Note: I recognize this is an old posting, but I wanted to add this information in case it helps any other users. Please add a comment if either of the suggestions above helped!

Hi @rylanatsafe​ ,

I am facing the very similar problem on windows.

In my case, I have successfully certificated server and it works, but when I run workspace, triggers following:

21-Aug-2022 15:14:32.328 SEVERE ahttps-openssl-apr-443-exec-20] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet EJobRunnerForm] in context with path [/fmeserver] threw exception
	java.net.ConnectException: Connection refused: connect
		at java.net.DualStackPlainSocketImpl.connect0(Native Method)
		at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:79)
		at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
		at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
		at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
		at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172)
		at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
		at java.net.Socket.connect(Socket.java:607)
		at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:681)
		at COM.safe.web.client.SelfSignedSSLSocketFactory.connectSocket(SelfSignedSSLSocketFactory.java:52)
		at org.apache.http.conn.scheme.SchemeSocketFactoryAdaptor.connectSocket(SchemeSocketFactoryAdaptor.java:66)
		at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
		at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
		at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134)
		at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:605)
		at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:440)
		at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835)
		at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:118)
		at COM.safe.web.client.HTTPClientFacade.execute(HTTPClientFacade.java:254)
		at COM.safe.fmeserver.webui.jobrun.JobRunnerHelper.runJob(JobRunnerHelper.java:193)
		at COM.safe.fmeserver.webui.servlet.rest.JobRunnerFormREST.handleRequest(JobRunnerFormREST.java:149)
		at COM.safe.fmeserver.webui.servlet.rest.JobRunnerFormREST.doPost(JobRunnerFormREST.java:61)
		at javax.servlet.http.HttpServlet.service(HttpServlet.java:681)
		at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
		at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
		at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
		at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
		at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
		at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
		at COM.safe.web.servlet.CharsetEncodingFilter.doFilter(CharsetEncodingFilter.java:541)
		at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
		at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
		at COM.safe.webservices.security.FMEServerAuthFilter.doFilter(FMEServerAuthFilter.java:130)
		at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
		at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
		at org.ebaysf.web.cors.CORSFilter.handleSimpleCORS(CORSFilter.java:467)
		at org.ebaysf.web.cors.CORSFilter.doFilter(CORSFilter.java:161)
		at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
		at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
		at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
		at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
		at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:660)
		at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
		at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
		at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
		at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
		at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
		at org.apache.coyote.http2.StreamProcessor.service(StreamProcessor.java:426)
		at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
		at org.apache.coyote.http2.StreamProcessor.process(StreamProcessor.java:87)
		at org.apache.coyote.http2.StreamRunnable.run(StreamRunnable.java:35)
		at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
		at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
		at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
		at java.lang.Thread.run(Thread.java:748)

I suppose EXTERNALHOSTNAME relates to docker.

What else would you suggest to check?

I have followed following steps: https://community.safe.com/s/article/Using-a-CA-Certificate-with-FME-Server, except first 6 steps ( and last 14-18 steps), because I have downloaded private.key, intermediate and certificate from CA and updated Connector in server.xml as follows:

    <Connector port="443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeyFile="C:\Program Files\FMEServer\Utilities\tomcat\conf\private.key"
                         certificateFile="C:\Program Files\FMEServer\Utilities\tomcat\conf\certificate.crt"
                         certificateChainFile="C:\Program Files\FMEServer\Utilities\tomcat\conf\ca_bundle.crt"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

I have also checked the following:

https://community.safe.com/s/article/run-a-service-from-web-ui-sample-job-fails

and imported as trusted:

https://community.safe.com/s/article/pkix-path-issues-when-configuring-ssl-for-fme-serv

but no help.

Any help would be very appreciated. 

Thank you,

Dejan

Hello @dejan11​ ,

Our documentation for "Configuring FME Server for HTTPS: Using a CA Certificate" mentions a different <Connector>  element for step "8. Configure Server.xml".

I see that you are setting this up using a different connector element - Would you be able to use the .pem format for all the files instead of the .key and .crt?

Hi @Merline George​ ,

Yes, I was able to convert .crt, *.key file to .pem and configure, but it is the same error.

I think there is something in FME Server configuration missing and I cannot find what exacly.

The certificate is valid both tried as crt, key or pem format.

Hello @dejan11​ ,

It might be best to submit a case at this point so as to look deeper into the FME Server config files or additional log files.

Just did, thanks.