Update troubleshooting.md
Add troubleshooting tip for 'PKIX path building failed' bug
@@ -85,3 +85,10 @@ You should be able to find both `bcpkix-jdk15on-1.52.jar` and `bcprov-jdk15on-1.
* copy both `bcpkix-jdk15on-1.52.jar` and `bcprov-jdk15on-1.52.jar` to `C:/Program Files/Java/[jre dir]/lib/ext/` and [install the bouncy castle security provider](http://www.bouncycastle.org/wiki/display/JA1/Provider+Installation) (suggested in: [issue#1393](https://github.com/researchstudio-sat/webofneeds/issues/1393))
* In the Tomcat server's `server.xml`, find the xml element `<Host appBase="webapps" ...` and add the xml attribute `startStopThreads="2"`
* **NOTE:** This only has an effect if two or more webapps, e.g. a node and an owner, are started on the server.
+
+ ## Exception in Owner-Webapp log: PKIX path building failed
+ One possible cause of this is that the [certificate renewal](/documentation/letsencrypt#certificate-renewal) updated the pem files but did not update the jks and pfx files. The consequence is that the node webapp uses the new key (as nginx loads the pem file) and the activemq server uses the old key (as it loads the jks file).
+
+*To check if this is the problem:* list the keys in the jks/pfx file (using `keytool -list -v -keystore t-keystore.pfx`) and compare them to the key information available for, eg. `https://{your-won-node}/won/resource` in the browser or some other http client. If the keys are the same, this is *not* the problem.
+
+*To fix this:* overwrite the jks and pfx files by exporting the key from the pem file. This can be done by executing the `openssl`and `keytool` commands in the letsencrypt's container script [certificate-request-and-renew.sh](/webofneeds/won-docker/image/letsencrypt/certificate-request-and-renew.sh)
