Introduction
Sometimes Artifactory may fail during startup, and the following errors (or similar information) would appear in the artifactory-service.log:
2026-02-07T03:01:13.607Z [jfrt ] [ERROR] [6b5071ce6e8dfa76] [tifactoryHomeConfigListener:55] [Catalina-utility-1 ] - Failed initializing Home. Caught exception:
java.lang.IllegalStateException: Could not find database table: db_properties
at org.artifactory.converter.VersionProviderImpl.init(VersionProviderImpl.java:150)
at org.artifactory.lifecycle.webapp.servlet.BasicConfigurationManager.initVersion(BasicConfigurationManager.java:173)
at org.artifactory.lifecycle.webapp.servlet.BasicConfigurationManager.initArtifactoryInstallation(BasicConfigurationManager.java:150)
at org.artifactory.lifecycle.webapp.servlet.BasicConfigurationManager.initialize(BasicConfigurationManager.java:137)
at org.artifactory.lifecycle.webapp.servlet.ArtifactoryHomeConfigListener.initBasicConfigManager(ArtifactoryHomeConfigListener.java:61)
at org.artifactory.lifecycle.webapp.servlet.ArtifactoryHomeConfigListener.contextInitialized(ArtifactoryHomeConfigListener.java:53)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4046)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:4474)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:164)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:599)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:571)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:654)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:632)
at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1880)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.IllegalStateException: Could not find database table: db_properties
at org.artifactory.common.config.db.DbVersionDao.isDbPropertiesTableExists(DbVersionDao.java:51)
at org.artifactory.converter.VersionProviderImpl.tryToResolveFromDb(VersionProviderImpl.java:238)
at org.artifactory.converter.VersionProviderImpl.getCompoundVersionDetailsFromDbIfExists(VersionProviderImpl.java:163)
at org.artifactory.converter.VersionProviderImpl.loadOriginalDbVersion(VersionProviderImpl.java:184)
at org.artifactory.converter.VersionProviderImpl.init(VersionProviderImpl.java:146)
... 20 common frames omitted
Caused by: org.postgresql.util.PSQLException: SSL error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:53)
at org.postgresql.core.v3.ConnectionFactoryImpl.enableSSL(ConnectionFactoryImpl.java:631)
at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:201)
at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:268)
at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:54)
at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:273)
at org.postgresql.Driver.makeConnection(Driver.java:446)
at org.postgresql.Driver.connect(Driver.java:298)
at com.zaxxer.hikari.util.DriverDataSource.getConnection(DriverDataSource.java:137)
at com.zaxxer.hikari.pool.PoolBase.newConnection(PoolBase.java:360)
at com.zaxxer.hikari.pool.PoolBase.newPoolEntry(PoolBase.java:202)
at com.zaxxer.hikari.pool.HikariPool.createPoolEntry(HikariPool.java:461)
at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:550)
at com.zaxxer.hikari.pool.HikariPool.<init>(HikariPool.java:98)
at com.zaxxer.hikari.HikariDataSource.getConnection(HikariDataSource.java:111)
at org.jfrog.storage.wrapper.JFrogDataSourceWrapper.getConnection(JFrogDataSourceWrapper.java:104)
at org.jfrog.storage.wrapper.JFrogDataSourceWrapper.invoke(JFrogDataSourceWrapper.java:73)
at jdk.proxy2/jdk.proxy2.$Proxy5.getConnection(Unknown Source)
at org.jfrog.storage.util.DbUtils.withMetadata(DbUtils.java:765)
at org.jfrog.storage.util.DbUtils.tableExists(DbUtils.java:275)
at org.artifactory.common.config.db.DbVersionUtil.isDbPropertiesTableExists(DbVersionUtil.java:50)
at org.artifactory.common.config.db.DbVersionDao.isDbPropertiesTableExists(DbVersionDao.java:48)
... 24 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:130)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1318)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1195)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1138)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:476)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:447)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
at org.postgresql.ssl.MakeSSL.convert(MakeSSL.java:51)
... 45 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:388)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:271)
at java.base/sun.security.validator.Validator.validate(Validator.java:256)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:230)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1302)
... 57 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:383)
... 62 common frames omitted
Or in access-service.log:
Caused by: org.flywaydb.core.internal.exception.FlywaySqlException: Unable to obtain connection from database (jdbc:postgresql://mypostgress.mydomain.com:5432/artifactory?ssl=true&sslfactory=org.postgresql.ssl.jdbc4.LibPQFactory&sslmode=verify-full&sslrootcert=/tmp/server.crt) for user 'artifactory': SSL error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
SQL State : 08006
Root Cause
The issue is not that the database tables are missing, but that Artifactory is unable to successfully connect to PostgreSQL via SSL.
The issue is commonly triggered by one or more of the following conditions:
- The CA certificate referenced by sslrootcert does not match the actual CA chain used by the PostgreSQL server.
- Only the root CA is trusted, while the required intermediate CA certificate is missing.
- One or more certificates in the server CA chain have recently expired (the Not After date has just passed or is approaching).
- sslmode=verify-full is enabled, but the PostgreSQL server certificate’s Subject Alternative Name (SAN) does not match the hostname specified in the JDBC connection URL.
Resolution
The `openssl s_client` command is a reliable and recommended starting point for diagnosing PostgreSQL SSL-related connection issues.
By using the following command, administrators can inspect and retrieve the actual certificate chain presented by the PostgreSQL server:
openssl s_client -connect <PG_HOST>:<PG_PORT> -starttls postgres -showcerts </dev/null > /tmp/server.crt
The generated file contains the certificate chain returned by the PostgreSQL server. This chain can be used to construct a valid CA bundle (typically including the intermediate and root CA certificates) for client-side trust verification.
After preparing the appropriate CA bundle, update the `$JFROG_HOME/artifactory/var/etc/system.yaml` file accordingly (need to restart Artifactory). For example:
shared:
database:
...
url: jdbc:postgresql://mypostgress.mydomain.com:5432/artifactory?ssl=true&sslmode=verify-ca&sslrootcert=/tmp/server.crt
...
In many SSL connection failures caused by an incorrect `sslrootcert`, missing intermediate CA certificates, or recent certificate rotation, using the certificate chain retrieved from the server to update the client-side trust configuration resolves the issue.
However, this approach does not resolve all SSL connection problems. In particular, issues related to hostname verification (`sslmode=verify-full` with a Subject Alternative Name mismatch), incomplete server-side certificate configuration, or incorrect JVM truststore usage, etc., are all required additional configuration changes beyond importing the retrieved certificates.