<p>I'm having this error in my pod and I have done 2 days of research to try to fix the error but i still can't figure out what's wrong.</p>
<blockquote>
<p>CWPKI0823E: SSL HANDSHAKE FAILURE:  A signer with SubjectDN [CN=cluster.us-south.containers.appdomain.cloud] was sent from the host [cloud.xxxx.container:443].  The signer might need to be added to local trust store [/opt/ibm/wlp/usr/servers/defaultServer/keycopy.jks], located in SSL configuration alias [defaultSSLSettings].  The extended error message from the SSL handshake exception is: [unable to find valid certification path to requested target].</p>
</blockquote>
<ol>
<li>I added a selfsigned certficate on the keycopy.jks which i created from my local machine. but i'm getting the same error.</li>
<li>tried to turn off the &quot;enable ssl verification&quot; to off and same error</li>
<li>and to add info, i have added the certificate i create in my postman in SETTINGS &gt; CERTIFICATION &gt; ADD CERTIFICATE.</li>
<li>i tried extracting a certificate from the keycopy.jks files itself and add it on my postmand request and still i'm having the same error.</li>
</ol>

Mak-mak
<p>Im no expert but have worked with SSL/TLS recently and found typically the SSL handshake failure occurs in the way you are experiencing when the common name (CN) does not match the hostname.</p>
<ol>
<li>you created a cert for some CN domain - e.g. <code>example.com</code></li>
<li>you then try to access the service using this SSL cert via <code>localhost:8080</code></li>
<li>the cert returned from the server was for <code>example.com</code> not <code>localhost</code>.. handshake fails and no connection is established</li>
</ol>
<p>Since you state you're getting a cert where the hostname/CN specified  is <code>CN=cluster.us-south.containers.appdomain.cloud</code> but the logs show a different domain <code>cloud.xxxx.container</code>, the connection fails - you're browser/ssl handshaker is trying to verify the host is who they say they are and getting a false result - so failing correctly.</p>
<p>If you are able to replace the cert to have <code>CN=cloud.xxxx.container</code> you will likely succeed in forming a connection.</p>
<p>Not sure if the following will work but it's quick/easy to test (and worked for my <code>example.com</code> vs. <code>localhost</code> example above, in the past, so I'll mention it, even though it may not work as expected (for testing purposes):</p>
<p>Create an entry in your <code>/etc/hosts</code> file:</p>
<pre><code>cluster.us-south.containers.appdomain.cloud   cloud.xxxx.container
</code></pre>
<p>This should result in your browser redirecting requests for <code>cluster.us-south.containers.appdomain.cloud</code> (for which the SSL cert will work) to <code>cloud.xxxx.container</code> without changing the url in the browser. This may enable the SSL handshake to succeed. Give it a go, let us know if it works.</p>
