# SSO error failed to establish trust with server at \[login.microsoftonline.com\]
**URL:** https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858
**Category:** Elasticsearch
**Created:** [January 11, 2024, 12:48pm UTC](https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858 "2024-01-11T12:48:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)
#### Post date: [January 11, 2024, 12:48pm UTC](https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858/1 "2024-01-11T12:48:14Z")
Hi, I came across a problem recently and I need urgent help. The machine that was running Elasticsearch was restarted and now the service will not run. The error is:
```auto
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:388) ~[?:?]
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:271) ~[?:?]
at sun.security.validator.Validator.validate(Validator.java:256) ~[?:?]
```
What is causing this issue? It was running before and now it is dead so why did SSO just behave like that?
Thank you in advance.
---
### Author:  [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [January 12, 2024, 9:53pm UTC](https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858/2 "2024-01-12T21:53:25Z")
Hi,
The error message indicates a problem with the certification path, which might be related to the Java truststore. Verify that the SSL certificate's root CA is present in the Java truststore. You may need to import the CA certificate into the truststore using the `keytool` command.
```auto
keytool -import -trustcacerts -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -noprompt -alias your_alias -file /path/to/your/ca_certificate.crt
```
Replace `your_alias` with a unique alias and provide the correct path to your CA certificate.
Regards
---
### Author:  [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)
#### Post date: [January 17, 2024, 11:09am UTC](https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858/3 "2024-01-17T11:09:30Z")
Yeah, but it had worked for 2 years before the reboot and I had a functioning SSO with SAML. What CA should I import into trustore?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2024, 11:10am UTC](https://discuss.elastic.co/t/sso-error-failed-to-establish-trust-with-server-at-login-microsoftonline-com/350858/4 "2024-02-14T11:10:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.