0

I am attempting to connect to a REST service through https (SSL) and it wasn't working. The error is PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. I traced the problem down do the fact that the Certificate Authority, a place called www.identrust.com, has not been added to the default list of trusted authorities in the JRE's default keystore. See Will the cross root cover trust by the default list in the JDK/JRE? or Which browsers and operating systems support Let’s Encrypt.

I have seen a few suggested solutions such as ignoring authentication (Java: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target), or importing the certificate into the JRE keystore (“unable to find valid certification path to requested target”, but browser says it's OK), but what I want to do is have my Java SE application successfully connect with SSL to sites that have certificates from www.identrust.com, as well as any other valid sites. In other words, I don't want to change the JRE keystore with every JDK update and I don't want to ignore the certificate.

I can get identrust's certificate from their website (Certificate Chain Download Instructions), so how do I add it into the "chain of trust" for my application?

Community
  • 1
  • 1
K.Nicholas
  • 10,956
  • 4
  • 46
  • 66

1 Answers1

2

Ignoring the server certificate check is very bad and insecure practice.

Importing the certificate into the JRE keystore is bad practice, too - considering that the JRE is updated several times a year which usually means that you have to import the certificate again.

The third and best option is to explicitly trust the missing CA certificate (or directly trusting the server certificate). You can do that by placing the certificate to-be-trusted in a separate Java keystore and include this keystore in your app (e.g. in the JAR file).

You can provide the custom trust store using the system property javax.net.ssl.trustStore or using the IMHO preferred way using a custom SSLContext implementation as described here: How do I accept a self-signed certificate with a Java HttpsURLConnection?

Community
  • 1
  • 1
Robert
  • 39,162
  • 17
  • 99
  • 152