Http Monitoring is not working and expecting a certificate for target url which can be accessed from proxy without certificate.

[smbazmi]

I can access my cloud run api (backend, https) from APIGee gateway but when i enable health monitoring load balancing feature it gives me following error:

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:456) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:323) at sun.security.validator.Validator.validate(Validator.java:271)

<HTTPTargetConnection> <SSLInfo> <Enabled>true</Enabled> </SSLInfo> <LoadBalancer> <Algorithm>RoundRobin</Algorithm> <Server name="dm1-east"/> <Server name="dm2-central"> <IsFallback>true</IsFallback> </Server> <MaxFailures>5</MaxFailures> <ServerUnhealthyResponse> <ResponseCode>404</ResponseCode> </ServerUnhealthyResponse> </LoadBalancer> <HealthMonitor> <IsEnabled>true</IsEnabled> <IntervalInSec>5</IntervalInSec> <HTTPMonitor> <Request> <ConnectTimeoutInSec>100</ConnectTimeoutInSec> <SocketReadTimeoutInSec>100</SocketReadTimeoutInSec> <Port>443</Port> <Verb>GET</Verb> <Path>/health</Path> </Request> <SuccessResponse> <ResponseCode>200</ResponseCode> </SuccessResponse> </HTTPMonitor> </HealthMonitor> </HTTPTargetConnection>

,

[Denis_KALITVI]

Well - it seems this is tls problem.

Can it be that your backend requires mTLS?

If not, can it be that your linux OS image don't have the CA issuer of tls certificate presented by backend in the trust store?