Update troubleshooting in building.md
Additional tip for 'PKIX path building failed' problem
@@ -444,7 +444,15 @@ You should be able to find both `bcpkix-jdk15on-1.52.jar` and `bcprov-jdk15on-1.
## Exception in Owner-Webapp log: PKIX path building failed
-One possible cause of this is that the [certificate renewal](/documentation/letsencrypt/README.md#certificate-renewal) updated the pem files but did not update the jks and pfx files. The consequence is that the node webapp uses the new key (as nginx loads the pem file) and the activemq server uses the old key (as it loads the jks file).
+This happens when the webapp uses a different public key than the activemq http endpoint.
+
+We have seen this happen in two different ways:
+1. The keys in the pem files and in the jks files are identical, but they were changed since the applications were started - most likely by a letsencrypt certificate renewal.
+2. There are different keys in the pem files than in the jks and pfx files
+
+If you suspect 1 might be the case, just restart the docker containers. If the problem goes away, that's what it was.
+
+In case 2, probably the [certificate renewal](/documentation/letsencrypt/README.md#certificate-renewal) updated the pem files but did not update the jks and pfx files. The consequence is that the node webapp uses the new key (as nginx loads the pem file) and the activemq server uses the old key (as it loads the jks file).
_To check if this is the problem:_ list the keys in the jks/pfx file (using `keytool -list -v -keystore t-keystore.pfx`) and compare them to the key information available for, eg. `https://{your-won-node}/won/resource` in the browser or some other http client. If the keys are the same, this is _not_ the problem.
