The viya4-orders-cli command might fail with the following TLS certificate validation error when you try to retrieve a bearer token:

tls: failed to verify certificate: x509: certificate is valid for 
apiproxy.sas.com, api.apiproxy.sas.com, management.apiproxy.sas.com, 
portal.apiproxy.sas.com, not api.sas.com

This error occurs when the CLI attempts to connect to https://api.sas.com/mysas/token.

Here is an example:

[username@host ~]$ viya4-orders-cli_linux_amd64 deploymentAssets $ORDER $CADENCE $VERSION --file-path ~/path/to/zips

INFO: using config file: /home/username/.viya4-orders-cli.env
ERROR: Bearer token request failed:
Post "https://api.sas.com/mysas/token":
tls: failed to verify certificate: x509: certificate is valid for 
apiproxy.sas.com, api.apiproxy.sas.com, management.apiproxy.sas.com, 
portal.apiproxy.sas.com, not api.sas.com

This issue typically occurs when authentication credentials are missing, outdated, or not compatible with the current API authentication flow.

• Credentials were generated prior to recent authentication updates.
• Credentials are not configured using the required format for API access.

Resolution

Complete the following steps to regenerate and configure credentials for the SAS^® Viya^® Orders API:

1. Review the Getting Started instructions in the viya4-orders-cli GitHub repository. When completing those steps, consider the following:
   1. Generate new credentials for the SAS Viya Orders API.
      
      
      
2. Encode the Client ID and Client Secret and save them to the configuration file:
   1. Run the following commands to append the encoded values to ~/.viya4-orders-cli.env:
      

      # Set temporary variable: Client ID from SAS Viya Orders API
      CLIENT_ID="XXXXXXXXXXX"
      # Set temporary variable: Client Secret from SAS Viya Orders API
      CLIENT_SECRET="XXXXXXXXXXX"

      
      # Write encoded values to config file
      echo -n "apimClientCredentialsId: " >> ~/.viya4-orders-cli.env && echo -n "$CLIENT_ID" | base64 >> ~/.viya4-orders-cli.env
      echo -n "apimClientCredentialsSecret: " >> ~/.viya4-orders-cli.env && echo -n "$CLIENT_SECRET" | base64 >> ~/.viya4-orders-cli.env

   2. Delete existing entries (if present) to avoid duplicate values in .viya4-orders-cli.env. If clientCredentialsId and clientCredentialsSecret still exist, you should remove them. 
   
   
   
3. Confirm that the configuration file contains the following:
   
   apimClientCredentialsId: <base64-encoded-clientId>
   apimClientCredentialsSecret: <base64-encoded-clientSecret>
   
   
4. Download the latest version of the viya4-orders-cli.
   
   
5. Re-run the viya4-orders-cli command.

Additional Option

As an alternative, you can set credentials using environment variables:

# Set temporary variables
CLIENT_ID=""
CLIENT_SECRET=""

export APIMCLIENTCREDENTIALSID=$(echo -n "$CLIENT_ID" | base64)
export APIMCLIENTCREDENTIALSSECRET=$(echo -n "$CLIENT_SECRET" | base64)

Note: This method applies to only the current session unless added to a shell profile.

Additional Information

• Ensure that credentials are generated using the current authentication process.
• Credential-related issues might present as TLS validation errors during API requests.