Test connection for the Active Directory source fails when Transport Layer Security (TLS) is on:java.

This is not the correct remediation mechanism for the certificate-path error described. Active Directory source configuration allows administrators to enable Transport Layer Security (TLS) for supported connections, but the source's TLS configuration is not simply a certificate-upload repository used to resolve a Java PKIX trust failure.

The underlying problem is that the Virtual Appliance performing the TLS connection cannot validate the certificate chain presented by Active Directory. Trust must therefore exist in the VA's applicable certificate trust location. SailPoint documentation states that when TLS is enabled for a supported source, the applicable certificate should normally be copied automatically to the associated VA cluster. Where manual remediation is required, certificate trust is handled at the VA level rather than by arbitrarily uploading an AD certificate to a source TLS settings page.

Administrators should verify the server certificate, issuing CA chain, hostname correspondence, and the trusted certificates available to the VA. Changing source settings without resolving VA trust will leave the TLS handshake failure unresolved.

Study Guide Reference: Virtual Appliances — TLS Configuration on VAs, Certificate Trust, Active Directory TLS Troubleshooting.

===============