Getting error: PKIX path building failed: unable to find valid certification path to requested target

Question

I'm trying to send a xml to another system via web service. But while trying to send i'm getting the following error. I've installed the certificate they gave to me. but still its not working.

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Where did you install the certificate? Is it a self-signed certificate? — Avi, Jun 30 '13 at 10:57
@Avi: I've installed the certificate in the java keytool. Its not a self-signed certificate. — Shamsuddin Tibriz, Jul 01 '13 at 03:58

score 5 · Answer 1 · answered Jun 30 '13 at 18:19

There are two possible sources for this error:

either the opposite side is using genuinely untrusted certificate (self-signed or signed by untrusted CA),
or the opposite side is not sending certificate validation chain (e.g. there is intermediate signing certificate along the way to your trusted CA, but this ceriticate is not present in the SSL handshake).

Solution for the first case is to add the untrusted CA (or the ceriticate itself) to your JRE truststore (${java.home}/lib/security/cacerts) or better - create your own truststore (which will not get removed when upgrading Java) and provide that to your application via javax.net.ssl.trustStore JVM property.

Solution for the second case is either to go with the first case solution or better - convince the opposite side to send correct certificate chain.

score 0 · Answer 2 · edited May 23 '17 at 12:23

Add certificate to JRE truststore @ ${java.home}/lib/security/cacerts OR if you have your own trustStore & provide path to that in your application/JVM. For example one possible way could be

or via java code

import java.util.Properties;
...
    Properties systemProps = System.getProperties();
    systemProps.put("javax.net.ssl.keyStorePassword","passwordForKeystore");
    systemProps.put("javax.net.ssl.keyStore","pathToKeystore.ks");
    systemProps.put("javax.net.ssl.trustStore", "pathToTruststore.ts");
    systemProps.put("javax.net.ssl.trustStorePassword","passwordForTrustStore");
    System.setProperties(systemProps);
...

For more refer to details on RedHat site

May be it will help refer to question

Getting error: PKIX path building failed: unable to find valid certification path to requested target

2 Answers2

Linked

Related