Java Quickstart for Google Sheets API Crashes with "PKIX path building failed"

Question

When running the sample in Java Quickstart for Google Sheets API, a Web page opens up in my default Web browser (Chrome) asking for permission. At this point, the console output is

2016-10-03 15:55:25.797:INFO::Logging to STDERR via org.mortbay.log.StdErrLog
2016-10-03 15:55:25.797:INFO::jetty-6.1.26
2016-10-03 15:55:25.809:INFO::Started SocketConnector@localhost:56854
Please open the following address in your browser:
  https://accounts.google.com/o/oauth2/auth?access_type=offline&client_id=1034043219121-gbc9p8gksiu5tn22ush3k6i3h6s4imvj.apps.googleusercontent.com&redirect_uri=http://localhost:56854/Callback&response_type=code&scope=https://www.googleapis.com/auth/spreadsheets.readonly
Attempting to open that address in the default browser now...

After I click the "Allow" button on the Web page, another Web page is displayed, which reads "Received verification code. You may now close this window...". At this point, the program crashes and the rest of the console output is

2016-10-03 15:55:32.653:INFO::Stopped SocketConnector@localhost:56854
Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1283)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1258)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
        at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:77)
        at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:981)
        at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:283)
        at com.google.api.client.googleapis.auth.oauth2.GoogleAuthorizationCodeTokenRequest.execute(GoogleAuthorizationCodeTokenRequest.java:158)
        at com.google.api.client.googleapis.auth.oauth2.GoogleAuthorizationCodeTokenRequest.execute(GoogleAuthorizationCodeTokenRequest.java:79)
        at com.google.api.client.extensions.java6.auth.oauth2.AuthorizationCodeInstalledApp.authorize(AuthorizationCodeInstalledApp.java:82)
        at SheetsQuickstart.authorize(SheetsQuickstart.java:73)
        at SheetsQuickstart.getSheetsService(SheetsQuickstart.java:86)
        at SheetsQuickstart.main(SheetsQuickstart.java:103)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
        at sun.security.validator.Validator.validate(Validator.java:260)
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
        ... 21 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
        ... 27 more

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':run'.
> Process 'command '/Library/Java/JavaVirtualMachines/jdk1.8.0_101.jdk/Contents/Home/bin/java'' finished with non-zero exit value 1

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.

I am not a Web programmer. Perhaps there is some basic setup that is not described in the Java Quickstart?

score 1 · Answer 1 · answered Oct 10 '16 at 21:07

1

My computer is running Sophos anti-virus software. I tried the example on another computer without Sophos and it worked fine. The problem could be caused by Sophos.

answered Oct 10 '16 at 21:07

Juan Casse

93
1
8

score 0 · Answer 2 · edited Jun 20 '20 at 09:12

As far as my searches are concerned, encountered error is caused by the missing certificate which should be added to the keystore file of JVM located at %JAVA_HOME%\lib\security\cacerts.

To solve the issue, I think this easy to follow technique given by @SimonSez in this SO post will really help. As stated:

First you can check if your certificate is already in the keystore by running the following command: keytool -list -keystore "%JAVA_HOME%/jre/lib/security/cacerts" (you don't need to provide a password)

If your certificate is missing you can get it by downloading it with your browser and add it to the keystore with the following command:

keytool -import -noprompt -trustcacerts -alias <AliasName> -file   <certificate> -keystore <KeystoreFile> -storepass <Password>

Afer import you can run the first command again to check if your certificate was added.

You may also get additional tips from this GitHub thread.

Java Quickstart for Google Sheets API Crashes with "PKIX path building failed"

2 Answers2