Certificate Error on Imports and Synchronisations (DOAJ Indexing Job Fails, ORCID Fails)Certificate Error on Imports and Synchronisations (DOAJ Indexing Job Fails, ORCID Fails)

What is the situation?

The problem can be seen with DOAJ, but also other services that uses SSL to connect (Single sign on, ORCID etc)

The error message can look like this:
Starting job...
INFO: Testing certificate...
FATAL: Certificate error: The certificate for DOAJ is either missing or expired. Please contact pure-support@atira.dk.

But also other error messages mentioning certificate errors can be fix like this:
java.security.cert.CertificateException: None matched in the job log

How to handle?

• Run the following command in a command prompt/shell to download the certificate:
• MAC:

openssl s_client -servername doaj.org -connect doaj.org:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/Users/mydirectory/doaj.pem
Or for Orcid
openssl s_client -servername pub.orcid.org -connect pub.orcid.org:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/Users/mydirectory/orcid.pem
OR for Sherpa Romeo (for 5.19 and above)
openssl s_client -servername v2.sherpa.ac.uk -connect v2.sherpa.ac.uk:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/Users/mydirectory/sherpa.pem
OR for IRUS
openssl s_client -servername irus.jisc.ac.uk -connect irus.jisc.ac.uk:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/Users/mydirectory/irus.pem
OR for datasearch
openssl s_client -servername api.datasearch.elsevier.com -connect api.datasearch.elsevier.com:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/Users/mydirectory/datasearch.pem

• Linux:

openssl s_client -servername doaj.org -connect doaj.org:443</dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >/home/mydirectory/doaj.pem

• Windows:
  if you can install openssl https://wiki.openssl.org/index.php/Binaries the command above should work on windows as well)
  (see option with firefox below)

If this is not related to doaj.org you need to replace doaj.org with the appropriate server name in the command above 

• Alternative option using firefox instead of linux/windows/mac comd prompt:
  Disable zscaler first or this will not work!
  go to the web-site in question https://doaj.org click on the lock 
  
  Then click on connection secure: 
  
  then click on more information
  
  then click on view certificate
  
  and finally click on PEM (CERT) to download the certificate
  

Once the certificate has been made: 

• Copy/paste the certificate (open the .pem file in a text editor, and copy the text from there) into the clients Pure under administrator -> certificate management
  
• Save once the certificate has validated, by pressing +add certificate
  • You need to change page and go back to certificate management before you can see the new certificate.
• The job should now work without the certificate error.

If there are existing certificates you might consider cleaning up. But in general, if you are in doubt, do not clean up.
The expired certificates should do no harm, and have no major performance impact, but if the naming is clear e.g. DOAJ.ORG and you know its expired, it would give a better overview if you clean it up.

More information

In KB-410 you can see more details about generating certificates and private keys for SSO
Visit KB-570 for adding PlumX certificates 
KB-600 What is ORCID