[🐛 Bug]: Could not start a new session. Response code 500. Message: javax.net.ssl.SSLHandshakeException

[d4vke]

What happened?

In our company we are using Selenium Grid installed via a helm chart and are using own our keda version

grid_0.39.0.txt
grid_0.18.0.txt

. We have 2 environments (one for production and one for testing). Current production grid is version 0.18.0 using Selenium v4.9.1-20230508. This one is working just fine.

We have recently updated our test environment to grid version 0.39.0 using Selenium v4.28.0-20250120.
We have noticed the huge amount of changes between both versions and we adapted the values.yaml for 0.39.0 as close the one from 0.18.0.

Deployment of version 0.39.0 went without any errors but when we run a test and connect to the test environment grid, we receive following error message:

org.openqa.selenium.SessionNotCreatedException:
Could not start a new session. Response code 500. Message: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Host info: host: 'FIN-5CD4058QMP', ip: '192.168.0.10'
Build info: version: '4.28.0', revision: 'ac342546e9'
System info: os.name: 'Windows 11', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.7'
Driver info: driver.version: unknown

This seems somewhere related to certificates, but I have no clue what, since we didn't use certificates in the past.
Ihave read the documentation about certificates but I don't know what to do exactly.

Command used to start Selenium Grid with Docker (or Kubernetes)

I have added both values.yaml files from 0.18.0 and 0.39.0 as attachments too (renamed to .txt) as I could show the full values.yaml here. Could someone point me to the right direction?

Relevant log output

org.openqa.selenium.SessionNotCreatedException: 
Could not start a new session. Response code 500. Message: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
Host info: host: 'FIN-5CD4058QMP', ip: '192.168.0.10'
Build info: version: '4.28.0', revision: 'ac342546e9'
System info: os.name: 'Windows 11', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.7'
Driver info: driver.version: unknown

Operating System

Kubernetes

Docker Selenium version (image tag)

v4.28.0-20250120

Selenium Grid chart version (chart version)

0.39.0

[github-actions]

@d4vke, thank you for creating this issue. We will troubleshoot it as soon as we can.

---

Info for maintainers

Triage this issue by using labels.

If information is missing, add a helpful comment and then I-issue-template label.

If the issue is a question, add the I-question label.

If the issue is valid but there is no time to troubleshoot it, consider adding the help wanted label.

If the issue requires changes or fixes from an external project (e.g., ChromeDriver, GeckoDriver, MSEdgeDriver, W3C), add the applicable G-* label, and it will provide the correct link and auto-close the issue.

After troubleshooting the issue, please add the R-awaiting answer label.

Thank you!

[VietND96]

Could not start a new session. Response code 500. Message: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

With this error, is your Grid endpoint using HTTPS?

[d4vke]

Hi @VietND96,

Yes it is using HTTPS, but so is the one in our production environment running on v0.18.0, which is running OK.

[VietND96]

Can you use helm template to render YAML with your values in chart 0.39.0 and share me resource of selenium-ingress?

[d4vke]

Hi @VietND96 ,

Not 100% sure if this is what you are asking for:

`$ helm template . -f values-tooling04.yaml | grep -E 'ingress'
Source: selenium-grid/templates/ingress.yaml

name: selenium-ingress
kubernetes.io/ingress.provider: nginx
nginx.ingress.kubernetes.io/client-body-buffer-size: 512M
nginx.ingress.kubernetes.io/proxy-body-size: 50m
nginx.ingress.kubernetes.io/proxy-buffer-size: 512M
nginx.ingress.kubernetes.io/proxy-buffering: "on"
nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-request-buffering: "on"
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-ssl-secret: default/certificate-wildcard
nginx.ingress.kubernetes.io/proxy-stream-timeout: "3600"
nginx.ingress.kubernetes.io/ssl-session-timeout: "3600"
nginx.ingress.kubernetes.io/upstream-keepalive-connections: "10000"
nginx.ingress.kubernetes.io/upstream-keepalive-request: "10000"
nginx.ingress.kubernetes.io/upstream-keepalive-time: 1h
nginx.ingress.kubernetes.io/upstream-keepalive-timeout: "3600"
nginx.ingress.kubernetes.io/use-http2: "true"
ingressClassName: tooling`

[VietND96]

Ok, I also just reproduced.

nginx.ingress.kubernetes.io/proxy-ssl-secret: default/certificate-wildcard

The secret resource certificate-wildcard is really in the namespace default?

[d4vke]

Ah no, this should be in the namespace trv-devtls-taf-test.
In the values files I changed the empty sslSecret to sslSecret: "trv-devtls-taf-test/certificate-wildcard" and redeployed.

This gives:

name: selenium-ingress
kubernetes.io/ingress.provider: nginx
nginx.ingress.kubernetes.io/client-body-buffer-size: 512M
nginx.ingress.kubernetes.io/proxy-body-size: 50m
nginx.ingress.kubernetes.io/proxy-buffer-size: 512M
nginx.ingress.kubernetes.io/proxy-buffering: "on"
nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-request-buffering: "on"
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-ssl-secret: trv-devtls-taf-test/certificate-wildcard
nginx.ingress.kubernetes.io/proxy-stream-timeout: "3600"
nginx.ingress.kubernetes.io/ssl-session-timeout: "3600"
nginx.ingress.kubernetes.io/upstream-keepalive-connections: "10000"
nginx.ingress.kubernetes.io/upstream-keepalive-request: "10000"
nginx.ingress.kubernetes.io/upstream-keepalive-time: 1h
nginx.ingress.kubernetes.io/upstream-keepalive-timeout: "3600"
nginx.ingress.kubernetes.io/use-http2: "true"
ingressClassName: tooling

But unfortunately i still get the same error.

[d4vke]

Hi @VietND96

When I export the grid certificate from the browser, and then import this certificate in my jdk truststore, then I am able to execute the tests without issues.

But I would like to know how I can avoid this? Because this would mean that every test automator in my company would need to import the certificate in their truststore and access to it is blocked for them.
Isn't there another way?

I would also want to know why this was/is not necessary for the grid version 0.18.0

[VietND96]

In your setup, the cert belongs to ingress only, right?
Can you try this https://www.selenium.dev/documentation/webdriver/drivers/http_client/ - look at method remoteWebDriverIgnoreSSL() to see any help?

[VietND96]

Chart 0.18.0 is too old, I am not sure which Grid core was there.
A few major changes that I can mention are

• Selenium 4.5.0 and beyond requires JDK11+ and using JdkHttpClient for ClientConfig
• In Java client 4.14.0 onwards, it allows to set SSL context to ignore SSL in HttpClient (which is the example I mentioned above).

[VietND96]

Moreover, when searching "Disable SSL certificate validation in Java", you probably I will see a few similar code snippets, or by setting JVM properties e.g https://stackoverflow.com/questions/54516557/disable-ssl-certificate-validation-in-java

[d4vke]

Hi @VietND96

Ok I will give it a try. I will come back with more feedback.

PS: grid 0.18.0 was using selenium 4.9.1