KB-1973 Adding a connected environment fails with "URL did not return valid public key" error

Symptoms

Adding a connected environment in the Admin Console for an Appian environment that has trusted IPs configured fails with the following error:

The following error is also observed in the application server log:

ERROR com.appiancorp.connectedenvironments.logging.DevOpsInfrastructureAuditLogger -  class="error">[ERROR, null, null, https://<other_site_subdomain>.appiancloud.com/suite, OUTGOING, null, null, null, null, null, null, null, null, null, URL did not return a valid public key: https://<other_site_subdomain>.appiancloud.com/suite]

The following PKIX error may also be present in the application server log:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Cause

There are two potential causes that could result in this issue:

If the PKIX error is present, then there is an issue with the certificate for the remote environment attempting to establish a Devops: Infrastructure connection. The web server certificates on both the first site and secondary site must be valid, and must be trusted by the other site respectively.
The second cause relates to trusted IPs and will differ based on installation type:

Cloud

The Appian Cloud region IP addresses have not been added to the other environment's IP allow list and connection attempts are being blocked.

Self-managed

Certain URL paths under /suite that are used by the Devops: Infrastructure connection are being blocked.

Action

To address any issues with the certificates for each site, follow the steps outlined in KB-1187 to have the web server certificates for each site added to the other site's default JDK trust store.
To address the issue with trusted IPs, follow the below steps based on installation type:

Cloud

Open a case with Appian Support to add the Appian Cloud region's IP addresses to the environment being added as a connected environment. See KB-1582 for specific IP addresses to add based on region.

Self-managed

Ensure that any URL starting with the following pattern is exempt from any allow list on both servers involved with the Devops: Infrastructure operation:

https://<other_site_URL>/suite/devops-infrastructure/

Affected Versions

This article applies to Appian versions 19.1 and later.

Last Reviewed: June 2020