LPI Imagery won't load

[BrackoNe]

What is the expected result?

When you are over New South Wales, Australia, you are able to select any LPI imagery from the main menu (Imagery/LPI *).

What happens instead?

I am able to select, but when you try to show any LPI imagery (10 of them) I constantly getting an Error: Problem loading tile. Any other imagery like Bing, Esri, MapBox, etc - works well. I have choose Blocker priority because I am really blocked to fill the gap by remaping names that are available on LPI NSW Base Map.

Please provide any additional information below. Attach a screenshot if possible.

Everything is working fine on iD editor!

URL:https://josm.openstreetmap.de/svn/trunk
Repository:UUID: 0c6e7542-c601-0410-84e7-c038aed88b3b
Last:Changed Date: 2018-09-12 00:54:12 +0200 (Wed, 12 Sep 2018)
Build-Date:2018-09-12 01:32:28
Revision:14247
Relative:URL: ^/trunk

Identification: JOSM/1.5 (14247 en) Windows 10 64-Bit
OS Build number: Windows 10 Enterprise 1803 (17134)
Memory Usage: 253 MB / 989 MB (116 MB allocated, but free)
Java version: 1.8.0_181-b13, Oracle Corporation, Java HotSpot(TM) Client VM
Screen: \Display0 1920x1080, \Display1 1920x1080, \Display2 1920x1080
Maximum Screen Size: 1920x1080
Dataset consistency test: No problems found

Plugins:
+ imagery_offset_db (34641)
+ turnrestrictions (34643)

Last errors/warnings:
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet
- W: java.io.IOException: Attribution is not loaded yet

[v-nebrac@…]

Bing maps is underneath LPI which shows Problem loading tile message.

[naoliv]

With JOSM:

2018-09-13 15:08:36.099 INFORMAÇÕES: GET https://maps.six.nsw.gov.au/arcgis/rest/services/public/NSW_Imagery/MapServer/tile/6/39/57 -> !!!
2018-09-13 15:08:36.100 ADVERTÊNCIA: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alerts.getSSLException(Alerts.java:198)
	at java.base/sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1974)
	at java.base/sun.security.ssl.Handshaker.fatalSE(Handshaker.java:345)
	at java.base/sun.security.ssl.Handshaker.fatalSE(Handshaker.java:339)
	at java.base/sun.security.ssl.ClientHandshaker.checkServerCerts(ClientHandshaker.java:1968)
	at java.base/sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1777)
	at java.base/sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:264)
	at java.base/sun.security.ssl.Handshaker.processLoop(Handshaker.java:1098)
	at java.base/sun.security.ssl.Handshaker.processRecord(Handshaker.java:1026)
	at java.base/sun.security.ssl.SSLSocketImpl.processInputRecord(SSLSocketImpl.java:1137)
	at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1074)
	at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
	at java.base/sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1402)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1429)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
	at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:567)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:163)
	at org.openstreetmap.josm.tools.HttpClient.connect(HttpClient.java:145)
	at org.openstreetmap.josm.tools.HttpClient.connect(HttpClient.java:91)
	at org.openstreetmap.josm.data.cache.JCSCachedTileLoaderJob.loadObject(JCSCachedTileLoaderJob.java:322)
	at org.openstreetmap.josm.data.cache.JCSCachedTileLoaderJob.run(JCSCachedTileLoaderJob.java:231)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1135)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:229)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:343)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:226)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:133)
	at java.base/sun.security.ssl.ClientHandshaker.checkServerCerts(ClientHandshaker.java:1947)
	... 20 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
	... 26 more

But opening ​https://maps.six.nsw.gov.au/arcgis/rest/services/public/NSW_Imagery/MapServer/tile/6/39/57 directly in the browser works.

[Don-vip]

This is a configuration error on the server side. You can check this as follows:

• go to ​https://www.digicert.com/help/
• enter ​https://maps.six.nsw.gov.au
• click "Check server"

Notice the results:

The server is not sending the required intermediate certificate.

In most cases, solving this problem in Apache is as simple as adding "SSLCertificateChainFile /path/to/DigiCertCA.crt" to your apache configuration file after/near your SSLCertificateFile line.

If you manage this server, you can download the file from ​this link or from your customer account area.

Follow the directions on ​our certificate installation guide to install the missing intermediate.

If you have any problems correcting this issue, please contact our helpful support team and we would be happy to assist.

Please e-mail the server admins with this information so that they can fix their configuration.

[BrackoNe]

Hi! I have contacted them thru website: ​https://maps.six.nsw.gov.au/

I am not sure whether they will receive my message or not. Also I am not sure how it is possible that Chrome doesn't report expired certificate, as well their imagery works fine for iD ediotr. Can you please explain this?

Thank you in advance,
Nemanja

[stoecker]

I am not sure whether they will receive my message or not. Also I am not sure how it is possible that Chrome doesn't report expired certificate, as well their imagery works fine for iD ediotr. Can you please explain this?

Webbrowsers not only add the root certificates, but also many many intermediate certificates to workaround such issues. In my eyes that was a very bad idea from the beginning, as this reduces the pressure on server operators to implement TLS right.

[BrackoNe]

It works again!

[stoecker]

Replying to brackone@…:

It works again!

Seems they switched back to the old Symantic cert which fails in Chrome :-)

That seems not the final solution, but probably a short-term fix until they solve it correctly with the new cert...

[Don-vip]

Thank you for contacting them. We can do nothing more as it seems they are now aware of the problem.