0

I'm running my app locally and getting following error when I call external API:

Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I understand it is beceause there is a lack of valid specific certficate which I need to add to my JDK. So, I get this from my chrome browser (downloading as a .cer file - Base-64 encoding).

I'm able to add it using keytool:

keytool -import -alias pint -keystore "C:\Program Files\Java\jdk-11.0.11\lib\security\cacerts" -trustcacerts -file pint33.cer

or directly in intelliJ IDEA (Settings -> Tools -> Server Certificates).

And it works, but for a very short term. It seems working for about one call to my app api. When I try to run my app process again I get errors. I can see in my certificate it should be valid until 7/15/22, but this is ignored somehow.

The way to make it working again is to download certficate from browser again, add it to jdk keystore and restart my app.

What is the explanation of this weird behavior? Do I miss something? Or do I do it completely wrong?

Rapiernik
  • 111
  • 3
  • 11
  • Are the certificates self-signed or by a CA (which CA)? BTW: Please do not modify the trust store that comes with Java. Installing an update to Java will revert those changes. Always build a custom trust store and use it. See e.g. https://stackoverflow.com/questions/24555890/using-a-custom-truststore-in-java-as-well-as-the-default-one – Robert Jul 16 '21 at 12:45
  • If you are behind a corporate SSL proxy, I would recommend that you add your CA to the JRE used by the IDE to avoid some IDE-related issues. Please see https://intellij-support.jetbrains.com/hc/en-us/community/posts/115000094584-IDEA-Ultimate-2016-3-4-throwing-unable-to-find-valid-certification-path-to-requested-target-when-trying-to-refresh-gradle?page=1#community_comment_115000405564  . – Egor Klepikov Jul 16 '21 at 14:02
  • Thanks for answers. It looks it is my Netskope Client issue. This software appears on our computers and probably is not configured properly by admins. – Rapiernik Jul 21 '21 at 05:58

0 Answers0