I'm trying to get tweets using twitter4j library for my java project which uses under the covers java.net.HttpURLConnection (as can be seen in stack trace). On my first run I got an error about certificate sun.security.validator.ValidatorException and sun.security.provider.certpath.SunCertPathBuilderException. Then I added twitter certificate by:
C:\Program Files\Java\jdk1.7.0_45\jre\lib\security>keytool -importcert -trustcacerts -file PathToCert -alias ca_alias -keystore "C:\Program Files\Java\jdk1.7.0_45\jre\lib\security\cacerts"
But without success. Here is the procedure to get tweets:
public static void main(String[] args) throws TwitterException {
ConfigurationBuilder cb = new ConfigurationBuilder();
cb.setDebugEnabled(true)
.setOAuthConsumerKey("myConsumerKey")
.setOAuthConsumerSecret("myConsumerSecret")
.setOAuthAccessToken("myAccessToken")
.setOAuthAccessTokenSecret("myAccessTokenSecret");
TwitterFactory tf = new TwitterFactory(cb.build());
Twitter twitter = tf.getInstance();
try {
Query query = new Query("iphone");
QueryResult result;
result = twitter.search(query);
System.out.println("Total amount of tweets: " + result.getTweets().size());
List<Status> tweets = result.getTweets();
for (Status tweet : tweets) {
System.out.println("#" + tweet.getUser().getScreenName() + " : " + tweet.getText());
}
} catch (TwitterException te) {
te.printStackTrace();
System.out.println("Failed to search tweets: " + te.getMessage());
}
And here is the error:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Relevant discussions can be found on the Internet at:
http://www.google.co.jp/search?q=d35baff5 or
http://www.google.co.jp/search?q=1446302e
TwitterException{exceptionCode=[d35baff5-1446302e 43208640-747fd158 43208640-747fd158 43208640-747fd158], statusCode=-1, message=null, code=-1, retryAfter=-1, rateLimitStatus=null, version=3.0.5}
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:177)
at twitter4j.internal.http.HttpClientWrapper.request(HttpClientWrapper.java:61)
at twitter4j.internal.http.HttpClientWrapper.get(HttpClientWrapper.java:81)
at twitter4j.TwitterImpl.get(TwitterImpl.java:1929)
at twitter4j.TwitterImpl.search(TwitterImpl.java:306)
at jku.cc.servlets.TweetsAnalyzer.main(TweetsAnalyzer.java:38)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at twitter4j.internal.http.HttpResponseImpl.<init>(HttpResponseImpl.java:34)
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:141)
... 5 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 20 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 26 more
Failed to search tweets: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Go to URL in your browser:
firefox - click on HTTPS certificate chain (the lock icon right next to URL address). Click "more info" > "security" > "show certificate" > "details" > "export..". Pickup the name and choose file type example.cer
chrome - click on site icon left to address in address bar, select "Certificate" -> "Details" -> "Export" and save in format "Der-encoded binary, single certificate".
Now you have file with keystore and you have to add it to your JVM. Determine location of cacerts files, eg.
C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts.
Next import the example.cer file into cacerts in command line (may need administrator command prompt):
keytool -import -alias example -keystore "C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts" -file example.cer
You will be asked for password which default is changeit
Restart your JVM/PC.
source:
http://magicmonster.com/kb/prg/java/ssl/pkix_path_building_failed.html
After many hours trying to build cert files to get my Java 6 installation working with the new twitter cert's, I finally stumbled onto an incredibly simple solution buried in a comment in one of the message boards. Just copy the cacerts file from a Java 7 installation and overwrite the one in your Java 6 installation. Probably best to make a backup of the cacerts file first, but then you just copy the new one in and BOOM! it just works.
Note that I actually copied a Windows cacerts file onto a Linux installation and it worked just fine.
The file is located in jre/lib/security/cacerts in both the old and new Java jdk installations.
Hope this saves someone else hours of aggravation.
MY UI approach:
Download keystore explorer from here
Open $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
Import your .crt file
CMD-Line:
keytool -importcert -file jetty.crt -alias jetty -keystore $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
1. Check the certificate
Try to load the target URL in browser and view the site's certificate (usually it's accessible by the icon with the lock sign. It's on the left or right side of the browser's address bar) whether it's expired or untrusted by other reason.
2. Install latest versions of JRE and JDK
New versions usually come with the updated set of the trusted certificates.
Also if it's possible, uninstall old versions. This will make misconfiguration errors explicit.
3. Check your configuration:
Check where your JAVA_HOME environment variable points to.
Check which java version you use to run the program. In IntelliJ check:
File -> Project Structure... -> Project Settings -> Project -> Project SDK:
File -> Project Structure... -> Platform Settings -> SDKs
4. Copy whole keystore from the new Java version
If you develop under the JDK other than the latest available - try to replace the %JAVA_HOME%/jre/lib/security/cacerts file with the new one from the latest installed JRE (make a backup copy first) as #jeremy-goodell suggests in his answer
5. Add certificate(s) to your keystore
If nothing above solves your problem use keytool to save certificate(s) to the Java's keystore:
keytool -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit -importcert -alias <alias_name> -file <path_to_crt_file>
File with the certificate can be obtained from the browser as #MagGGG suggests in his answer.
Note 1: you may need to repeat this for every certificate in the chain to you site's certificate. Start from the root one.
Note 2: <alias_name> should be unique among the keys in the store or keytool will show an error.
To get list of all the certificates in the store you may run:
keytool -list -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
In case something goes wrong this will help you to remove certificate from the store:
keytool -delete -alias <alias_name> -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
-Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true
It is used for jump the certificate validation.
Warning!
Only use for development purposes for this is unsecure!
I have stumbled upon this issue which took many hours of research to fix, specially with auto-generated certificates, which unlike Official ones, are quite tricky and Java does not like them that much.
Please check the following link: Solve Problem with certificates in Java
Basically you have to add the certificate from the server to the Java Home certs.
Generate or Get your certificate and configure Tomcat to use it in Servers.xml
Download the Java source code of the class InstallCert and execute it while the server is running, providing the following arguments server[:port]. No password is needed, as the original password works for the Java certs ("changeit").
The Program will connect to the server and Java will throw an exception, it will analyze the certificate provided by the server and allow you to create a jssecerts file inside the directory where you executed the Program (If executed from Eclipse then make sure you configure the Work directory in Run -> Configurations).
Manually copy that file to $JAVA_HOME/jre/lib/security
After following these steps, the connections with the certificate will not generate exceptions anymore within Java.
The following source code is important and it disappeared from (Sun) Oracle blogs, the only page I found it was on the link provided, therefore I am attaching it in the answer for any reference.
/*
* Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* - Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* - Neither the name of Sun Microsystems nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* Originally from:
* http://blogs.sun.com/andreas/resource/InstallCert.java
* Use:
* java InstallCert hostname
* Example:
*% java InstallCert ecc.fedora.redhat.com
*/
import javax.net.ssl.*;
import java.io.*;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
/**
* Class used to add the server's certificate to the KeyStore
* with your trusted certificates.
*/
public class InstallCert {
public static void main(String[] args) throws Exception {
String host;
int port;
char[] passphrase;
if ((args.length == 1) || (args.length == 2)) {
String[] c = args[0].split(":");
host = c[0];
port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
String p = (args.length == 1) ? "changeit" : args[1];
passphrase = p.toCharArray();
} else {
System.out.println("Usage: java InstallCert [:port] [passphrase]");
return;
}
File file = new File("jssecacerts");
if (file.isFile() == false) {
char SEP = File.separatorChar;
File dir = new File(System.getProperty("java.home") + SEP
+ "lib" + SEP + "security");
file = new File(dir, "jssecacerts");
if (file.isFile() == false) {
file = new File(dir, "cacerts");
}
}
System.out.println("Loading KeyStore " + file + "...");
InputStream in = new FileInputStream(file);
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, passphrase);
in.close();
SSLContext context = SSLContext.getInstance("TLS");
TrustManagerFactory tmf =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);
X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
context.init(null, new TrustManager[]{tm}, null);
SSLSocketFactory factory = context.getSocketFactory();
System.out.println("Opening connection to " + host + ":" + port + "...");
SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
socket.setSoTimeout(10000);
try {
System.out.println("Starting SSL handshake...");
socket.startHandshake();
socket.close();
System.out.println();
System.out.println("No errors, certificate is already trusted");
} catch (SSLException e) {
System.out.println();
e.printStackTrace(System.out);
}
X509Certificate[] chain = tm.chain;
if (chain == null) {
System.out.println("Could not obtain server certificate chain");
return;
}
BufferedReader reader =
new BufferedReader(new InputStreamReader(System.in));
System.out.println();
System.out.println("Server sent " + chain.length + " certificate(s):");
System.out.println();
MessageDigest sha1 = MessageDigest.getInstance("SHA1");
MessageDigest md5 = MessageDigest.getInstance("MD5");
for (int i = 0; i < chain.length; i++) {
X509Certificate cert = chain[i];
System.out.println
(" " + (i + 1) + " Subject " + cert.getSubjectDN());
System.out.println(" Issuer " + cert.getIssuerDN());
sha1.update(cert.getEncoded());
System.out.println(" sha1 " + toHexString(sha1.digest()));
md5.update(cert.getEncoded());
System.out.println(" md5 " + toHexString(md5.digest()));
System.out.println();
}
System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
String line = reader.readLine().trim();
int k;
try {
k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
} catch (NumberFormatException e) {
System.out.println("KeyStore not changed");
return;
}
X509Certificate cert = chain[k];
String alias = host + "-" + (k + 1);
ks.setCertificateEntry(alias, cert);
OutputStream out = new FileOutputStream("jssecacerts");
ks.store(out, passphrase);
out.close();
System.out.println();
System.out.println(cert);
System.out.println();
System.out.println
("Added certificate to keystore 'jssecacerts' using alias '"
+ alias + "'");
}
private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();
private static String toHexString(byte[] bytes) {
StringBuilder sb = new StringBuilder(bytes.length * 3);
for (int b : bytes) {
b &= 0xff;
sb.append(HEXDIGITS[b >> 4]);
sb.append(HEXDIGITS[b & 15]);
sb.append(' ');
}
return sb.toString();
}
private static class SavingTrustManager implements X509TrustManager {
private final X509TrustManager tm;
private X509Certificate[] chain;
SavingTrustManager(X509TrustManager tm) {
this.tm = tm;
}
public X509Certificate[] getAcceptedIssuers() {
throw new UnsupportedOperationException();
}
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
throw new UnsupportedOperationException();
}
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
this.chain = chain;
tm.checkServerTrusted(chain, authType);
}
}
}
Mac
The accepted answer does not work for Mac as there is no Export button available in Mac (Chrome or Firefox). Please check this answer to download the certificate and follow the next steps as mentioned below:
List all certificates installed in the keystore:
cd $JAVA_HOME/lib/security
keytool -list -keystore cacerts
Notes:
The default password of the keystore is: changeit.
For Java-8 or lower version use the command, cd $JAVA_HOME/jre/lib/security
Before you import the certificate in the keystore, make a backup of the keystore:
sudo cp cacerts cacerts.bak
Import the downloaded certificate in the keystore:
sudo keytool -importcert -alias youralias -file /path/to/the/downloaded/certificate -keystore cacerts
Check if the certificate is stored in the keystore:
sudo keytool -list -keystore cacerts -alias youralias
If you want to see more detailed information, add the -v flag:
sudo keytool -v -list -keystore cacerts -alias youralias
I wanted to import certificate for smtp.gmail.com. The only solution that worked for me is
Enter command to view this certificate
D:\openssl\bin\openssl.exe s_client -connect smtp.gmail.com:465
Copy and save the lines between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- into a file, gmail.cer
Run
keytool -import -alias smtp.gmail.com -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -file C:\Users\Admin\Desktop\gmail.cer
Enter password: changeit
Click "Yes" to import the certificate
Restart Java
Now run the command and you are good to go.
I had a slightly different situation, when both JDK and JRE 1.8.0_112 were present on my system.
I imported the new CA certificates into [JDK_FOLDER]\jre\lib\security\cacerts using the already known command:
keytool -import -trustcacerts -keystore cacerts -alias <new_ca_alias> -file <path_to_ca_cert_file>
Still, I kept getting the same PKIX path building failed error.
I added debug information to the java CLI, by using java -Djavax.net.debug=all ... > debug.log. In the debug.log file, the line that begins with trustStore is: actually pointed to the cacerts store found in [JRE_FOLDER]\lib\security\cacerts.
In my case the solution was to copy the cacerts file used by JDK (which had the new CAs added) over the one used by the JRE and that fixed the issue.
This isn't a Twitter-specific answer, but this is the question that comes up when you search for this error. If your system is receiving this error when connecting to a website that appears to have a valid certificate when viewed in a web browser, that probably means that website has an incomplete certificate chain.
For a brief summary of the problem: Certificate Authorities don't use their Root Certificate to sign just any old certificate. Instead, they (usually) sign intermediate certificates that also have the Certificate Authority flag set (that is, are allowed to sign certificates). Then when you purchase a certificate from a CA, they sign your CSR with one of these intermediate certificates.
Your Java trust store most likely only has the Root Cert, not the intermediate ones.
A misconfigured site might return just their signed cert. Problem: it was signed with an intermediate cert that's not in your trust store. Browsers will handle this problem by downloading or using a cached intermediate certificate; this maximizes website compatibility. Java and tools like OpenSSL, however, won't. And that will cause the error in the question.
You can verify this suspicion by using the Qualys SSL Test. If you run that against a site and it says
This server's certificate chain is incomplete.
then that confirms it. You can also see this by looking at the certification paths and seeing the text Extra Download.
How to fix it: the server administrator needs to configure the web server to return the intermediate certificates as well. For Comodo, for example, this is where the .ca-bundle file comes in handy. For example, in an Apache configuration with mod_ssl, you'd use the SSLCertificateChainFile configuration setting. For nginx, you need to concatenate the intermediate certificates and the signed certificate and use that in the SSL cert configuration. You can find more by searching for "incomplete certificate chain" online.
Issue Background:
I was getting following error when i try to run mvn clean install in my project and through Netbeans IDE clean and build option.
This issue is due to certificate not available when we download through NET beans IDE/through command prompt, but able to download the files through the browser.
Error:
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact com.java.project:product:jar:1.0.32 from/to repo-local (https://url/local-repo): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Resolution:
1. Download the certificate of the Url in question:
Launch IE by "run as adminstrator" (otherwise, we will not be able to download the certificate)
Enter the url in IE-> https://url/local-repo
(In my case this url had a untrusted certificate.)
Download the certificate by clicking on Certificate error -> view certificate
Select Details tab -> copy to file -> next -> select "DER encoded binary X.509 (.CER)
save the certificate in some location, example : c:/user/sheldon/desktop/product.cer
Congrats! you have successfully downloaded the certificate for the site
2. Now install the key store to fix the issue.
Run the keytool command to append the downloaded keystore into the
existing certificate file.
Command: Below command in the bin folder of jdk (JAVA_HOME).
C:\Program Files\Java\jdk1.8.0_141\jre\bin>keytool -importcert -file
"C:/user/sheldon/desktop/product.cer" -alias product -keystore
"C:/Program Files/Java/jdk1.8.0_141/jre/lib/security/cacerts".
You will be prompted to enter password. Enter keystore password:
enter "changeit" again for "Trust this certificate? [no]:", enter
"yes"
Sample command line commands/output:
keytool -importcert -file "C:/Users/sheldon/Desktop/product.cer" -alias product -keystore "C:/Program iles/Java/jdk1.8.0_141/jre/lib/security/cacerts"
Enter keystore password:
Trust this certificate? [no]: yes
Certificate was added to keystore
Contgrats! now you should have got rid of "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException" error in your Netbeans IDE.
This is a solution but in form of my story with this problem:
I was almost dead trying all the solutions given above(for 3 days ) and nothing worked for me.
I lost all hope.
I contacted my security team regarding this because I was behind a proxy and they told me that they had recently updated their security policy.
Later they issued a new "cacerts" file which contains all the certificates.
I removed the cacerts file which is present inside %JAVA_HOME%/jre/lib/security and it solved my problem.
So if you are facing this issue it might be from your network team also like this.
After struggling for half-day, found one more way to solve this problem. I was able to solve this in MAC 10.15.5 ( Catalina). Followed the below steps.
This problem occurs when we are running behind a company proxy , In my case its Zscaler.
Open Key chain access, export CA certificate.(Select CA certificate, File->export items and save with the desired name)
Copy the path of existing cacerts from java folder(/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
)
Open terminal and navigate to the Keytool folder (/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/bin
)
Run the below command.
Keytool -importcert - file (Path to exported cert from the keychainaccess) -alias (give a name) -keystore (Path of existing cacerts from java folder)
sudo Keytool -importcert -file /Users/Desktop/RootCA.cer -alias demo -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
It will ask for password , give it as : changeit
It asks for confirmation , Say : yes
After all of these steps, Quit eclipse and terminal start fresh session.
The reason, we get above error is that JDK is bundled with a lot of trusted Certificate Authority(CA) certificates into a file called ‘cacerts’ but this file has no clue of our self-signed certificate. In other words, the cacerts file doesn’t have our self-signed certificate imported and thus doesn’t treat it as a trusted entity and hence it gives the above error.
How to fix the above error
To fix the above error, all we need is to import the self-signed certificate into the cacerts file.
First, locate the cacerts file. We will need to find out the JDK location. If you are running your application through one of the IDE’s like Eclipse or IntelliJ Idea go to project settings and figure out what is the JDK location.
For e.g on a Mac OS typical location of cacerts file would be at this location /Library/Java/JavaVirtualMachines/ {{JDK_version}}/Contents/Home/jre/lib/security
on a Window’s machine it would be under {{Installation_directory}}/{{JDK_version}}/jre/lib/security
Once you have located the cacerts file, now we need to import our self-signed certificate to this cacerts file. Check the last article, if you don’t know how to generate the self-signed certificate correctly.
If you don’t have a certificate file(.crt) and just have a .jks file you can generate a .crt file by using below command. In case you already have a .crt/.pem file then you can ignore below command
##To generate certificate from keystore(.jks file) ####
keytool -export -keystore keystore.jks -alias selfsigned -file selfsigned.crt
Above step will generate a file called selfsigned.crt.Now Import the certificate to cacerts
Now add the certificate to JRE/lib/security/cacerts (trustore)
keytool -importcert -file selfsigned.crt -alias selfsigned -keystore {{cacerts path}}
for e.g
keytool -importcert -file selfsigned.nextgen.crt -alias selfsigned.nextgen -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_171.jdk/Contents/Home/jre/lib/security/cacerts
That’s all, restart your application and it should work fine. If it still doesn’t work and get an SSL handshake exception. It probably means you are using different domain then registered in the certificate.
The Link with detailed explanation and step by step resolution is over here.
I was facing the same issue and get it resolved using the below simple steps:
1) Download the InstallCert.java from google
2) Compile it using javac InstallCert.java
3) Run InstallCert.java using java InstallCert.java, with the hostname and https port, and press “1” when asking for input. It will add the “localhost” as a trusted keystore, and generate a file named “jssecacerts“ as below:
java InstallCert localhost:443
4) copy the jssecacerts into $JAVA_HOME/jre/lib/security folder
Main source to resolve the issue here is:
https://ankurjain26.blogspot.in/2017/11/javaxnetsslsslhandshakeexception.html
Problem is, your eclipse is not able to connect the site which actually it is trying to.
I have faced similar issue and below given solution worked for me.
Turn off any third party internet security application e.g. Zscaler
Sometimes also need to disconnect VPN if you are connected.
Thanks
Adding cacerts did not work for me.
After enabling log with flag -Djavax.net.debug=all, then came to know java reading from jssecacerts.
Import to jssecacerts worked finally.
For me, certificate error popped up because I had fiddler running in background and that messes up with certificate. It acts as a proxy so close that and restart eclipse.
I came across this question while trying to install the Cucumber-Eclipse plugin in Eclipse via their update site. I received the same SunCertPathBuilderException error:
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
While some of the other answers are appropriate and helpful for this question's given situation, they were nevertheless unhelpful and misleading for my issue.
In my case, the issue was that the URL provided for their update site is:
https://cucumber.io/cucumber-eclipse/update-site
However when navigating to it via a browser, it redirected to (note the added ".github"):
http://cucumber.github.io/cucumber-eclipse/update-site/
So the resolution is to simply use the redirected version of the update site URL when adding the update site in eclipse.
goals:
use https connections
verify SSL chains
do not deal with cacerts
add certificate in runtime
do not lose certificates from cacerts
How to do it:
define own keystore
put certificate into keystore
redefine SSL default context with our custom class
???
profit
My Keystore wrapper file:
public class CertificateManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private String keyStoreLocation;
private String keyStorePassword;
private X509TrustManager myTrustManager;
private static KeyStore myTrustStore;
public CertificateManager(String keyStoreLocation, String keyStorePassword) throws Exception {
this.keyStoreLocation = keyStoreLocation;
this.keyStorePassword = keyStorePassword;
myTrustStore = createKeyStore(keyStoreLocation, keyStorePassword);
}
public void addCustomCertificate(String certFileName, String certificateAlias)
throws Exception {
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null);
Certificate certificate = myTrustStore.getCertificate(certificateAlias);
if (certificate == null) {
logger.info("Certificate not exists");
addCertificate(certFileName, certificateAlias);
} else {
logger.info("Certificate exists");
}
tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(myTrustStore);
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
setMytrustManager((X509TrustManager) tm);
logger.info("Trust manager found");
break;
}
}
}
private InputStream fullStream(String fname) throws IOException {
ClassLoader classLoader = getClass().getClassLoader();
InputStream resource = classLoader.getResourceAsStream(fname);
try {
if (resource != null) {
DataInputStream dis = new DataInputStream(resource);
byte[] bytes = new byte[dis.available()];
dis.readFully(bytes);
return new ByteArrayInputStream(bytes);
} else {
logger.info("resource not found");
}
} catch (Exception e) {
logger.error("exception in certificate fetching as resource", e);
}
return null;
}
public static KeyStore createKeyStore(String keystore, String pass) throws Exception {
try {
InputStream in = CertificateManager.class.getClass().getResourceAsStream(keystore);
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(in, pass.toCharArray());
logger.info("Keystore was created from resource file");
return keyStore;
} catch (Exception e) {
logger.info("Fail to create keystore from resource file");
}
File file = new File(keystore);
KeyStore keyStore = KeyStore.getInstance("JKS");
if (file.exists()) {
keyStore.load(new FileInputStream(file), pass.toCharArray());
logger.info("Default keystore loaded");
} else {
keyStore.load(null, null);
keyStore.store(new FileOutputStream(file), pass.toCharArray());
logger.info("New keystore created");
}
return keyStore;
}
private void addCertificate(String certFileName, String certificateAlias) throws CertificateException,
IOException, KeyStoreException, NoSuchAlgorithmException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream certStream = fullStream(certFileName);
Certificate certs = cf.generateCertificate(certStream);
myTrustStore.setCertificateEntry(certificateAlias, certs);
FileOutputStream out = new FileOutputStream(getKeyStoreLocation());
myTrustStore.store(out, getKeyStorePassword().toCharArray());
out.close();
logger.info("Certificate pushed");
}
public String getKeyStoreLocation() {
return keyStoreLocation;
}
public String getKeyStorePassword() {
return keyStorePassword;
}
public X509TrustManager getMytrustManager() {
return myTrustManager;
}
public void setMytrustManager(X509TrustManager myTrustManager) {
this.myTrustManager = myTrustManager;
}
}
This class will create keystore if necessary, and will be able to manage certificates inside of it. Now class for SSL context:
public class CustomTrustManager implements X509TrustManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private static SSLSocketFactory socketFactory;
private static CustomTrustManager instance = new CustomTrustManager();
private static List<CertificateManager> register = new ArrayList<>();
public static CustomTrustManager getInstance() {
return instance;
}
private X509TrustManager defaultTm;
public void register(CertificateManager certificateManager) {
for(CertificateManager manager : register) {
if(manager == certificateManager) {
logger.info("Certificate manager already registered");
return;
}
}
register.add(certificateManager);
logger.info("New Certificate manager registered");
}
private CustomTrustManager() {
try {
String algorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
tmf.init((KeyStore) null);
boolean found = false;
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
defaultTm = (X509TrustManager) tm;
found = true;
break;
}
}
if(found) {
logger.info("Default trust manager found");
} else {
logger.warn("Default trust manager was not found");
}
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[]{this}, null);
SSLContext.setDefault(sslContext);
socketFactory = sslContext.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);
logger.info("Custom trust manager was set");
} catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
logger.warn("Custom trust manager can't be set");
e.printStackTrace();
}
}
#Override
public X509Certificate[] getAcceptedIssuers() {
List<X509Certificate> out = new ArrayList<>();
if (defaultTm != null) {
out.addAll(Arrays.asList(defaultTm.getAcceptedIssuers()));
}
int defaultCount = out.size();
logger.info("Default trust manager contain " + defaultCount + " certficates");
for(CertificateManager manager : register) {
X509TrustManager customTrustManager = manager.getMytrustManager();
X509Certificate[] issuers = customTrustManager.getAcceptedIssuers();
out.addAll(Arrays.asList(issuers));
}
logger.info("Custom trust managers contain " + (out.size() - defaultCount) + " certficates");
X509Certificate[] arrayOut = new X509Certificate[out.size()];
return out.toArray(arrayOut);
}
#Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by custom trust manager");
return;
} catch (Exception e) {
}
}
if (defaultTm != null) {
defaultTm.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by default trust manager");
} else {
logger.info("Certificate chain (server) was rejected");
throw new CertificateException("Can't check server trusted certificate.");
}
}
#Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
try {
if (defaultTm != null) {
defaultTm.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by default trust manager");
} else {
throw new NullPointerException();
}
} catch (Exception e) {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by custom trust manager");
return;
} catch (Exception e1) {
}
}
logger.info("Certificate chain (client) was rejected");
throw new CertificateException("Can't check client trusted certificate.");
}
}
public SSLSocketFactory getSocketFactory() {
return socketFactory;
}
}
This class made as singleton, because only one defaultSSL context allowed. So, now usage:
CertificateManager certificateManager = new CertificateManager("C:\\myapplication\\mykeystore.jks", "changeit");
String certificatePath = "C:\\myapplication\\public_key_for_your_ssl_service.crt";
try {
certificateManager.addCustomCertificate(certificatePath, "alias_for_public_key_for_your_ssl_service");
} catch (Exception e) {
log.error("Can't add custom certificate");
e.printStackTrace();
}
CustomTrustManager.getInstance().register(certificateManager);
Possibly, it will not work with this settings, because I keep certificate file inside of resource folder, so my path is not absolute. But generally, it work perfectly.
If your repository URL also work on HTTP and the security is not a concern, you can go to settings.xml (often, but not always, located in %USERPROFILE%/.m2) and replace HTTPS with HTTP for <repository> and <pluginRepository> URLs.
For example, this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
should be replaced by this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
I was using my own trust store rather than JRE one by passing arg -Djavax.net.ssl.trustStore=
I was getting this error regardless of certs in truststore. The issue for me was the ordering of of the properties passed on arg line.
When i put -Djavax.net.ssl.trustStore=& -Djavax.net.ssl.trustStorePassword= before -Dspring.config.location= & -jar args i was able to successfully invoke my rest call over https.
I solved this issue on Windows Server 2016 with Java 8, by importing cert from pkcs12 store to cacerts keystore.
Path to pkcs12 store:
C:\Apps\pkcs12.pfx
Path to Java cacerts:
C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts
Path to keytool:
C:\Program Files\Java\jre1.8.0_151\bin
After possitioning to folder with keytool in command prompt (as administrator), command to import cert from pkcs12 to cacerts is as follows:
keytool -v -importkeystore -srckeystore C:\Apps\pkcs12.pfx -srcstoretype PKCS12 -destkeystore "C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts" -deststoretype JKS
You will be prompted to:
1. enter destination keystore password (cacerts pasword, default is "changeit")
2. enter source keystore password (pkcs12 password)
For changes to take effect, restart server machine (or just restart JVM).
I ran into same issue but updating wrong jre on my linux machine. It is highly likely that tomcat is using different jre and your cli prompt is configured to use a different jre.
Make sure you are picking up the correct jre.
Step #1:
ps -ef | grep tomcat
You will see some thing like:
root 29855 1 3 17:54 pts/3 00:00:42 /usr/java/jdk1.7.0_79/jre/bin/java
Now use this:
keytool -import -alias example -keystore /usr/java/jdk1.7.0_79/jre/lib/security/cacerts -file cert.cer
PWD: changeit
*.cer file can be geneated as shown below: (or you can use your own)
openssl x509 -in cert.pem -outform pem -outform der -out cert.cer
If you are still getting this error
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target
after executing the below command and restarting the java process
keytool -import -alias certificatealias -keystore C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts -file certificate.cer
Then there is some issue in JDK. Try to install JDK from a trusted provider.
Once you reinstalled it from trusted provider you won't face this issue.
Simple Steps to resolve this Exception, (I did it on java 11),
First you need to Download the public SSL certificate file of the target domain that you are trying to call,for that
Open the target domain website in the chrome (Example: https://amazonservice.domain.com)
Click on the small lock icon before the URL in the browser
Click View certificates
Now Click on Certificate is valid as shown below
Now a new Popup will open as shown below,
Open the details tab
Select the RootCert at the top
Click Export and save the .cer file to your system in a directory
Now you have the public keystore of your target domain which you are trying to call in your java application,now we need to impot that keystore into you jre,for that go to the $JAVA_HOME/bin directory and run the following command
./keytool -importcert -alias someAliasName -keystore {JAVA_HOME}/lib/security/cacerts -file {PathToDownloads}/certificateFileName.cer
It will ask you for password, enter the password if you know, the default password for the certificate is changeit
References
https://confluence.atlassian.com/kb/how-to-import-a-public-ssl-certificate-into-a-jvm-867025849.html
https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html
In case your host sits behind firewall/proxy , use following command in cmd:
keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>
Replace <proxy_hostname> and <proxy_port> with the HTTP proxy server that is configured. Replace <remote_host_name:remote_ssl_port> with one of the remote host (basically url) and port having the certification problem.
Take the last certificate content printed and copy it (also copy begin and end certificate). Paste it in text file and give .crt extension to it . Now import this certificate to cacerts using java keytool command and it should work .
keytool -importcert -file <filename>.crt -alias randomaliasname -keystore %JAVA_HOME%/jre/lib/security/cacerts -storepass changeit
1-First of all, import you'r crt file into {JAVA_HOME}/jre/security/cacerts, if you still faced with this exception, change you'r jdk version. For example from jdk1.8.0_17 to jdk1.8.0_231
I was facing this issue with Java 8 but it got solved after upgrading to Java 11
Here normally this kind of exception occurs when there is mismatch in the PATH of trusted certificate. Check the configuration or path where this server certificate is required for secured communication.
Related
I'm trying to get tweets using twitter4j library for my java project which uses under the covers java.net.HttpURLConnection (as can be seen in stack trace). On my first run I got an error about certificate sun.security.validator.ValidatorException and sun.security.provider.certpath.SunCertPathBuilderException. Then I added twitter certificate by:
C:\Program Files\Java\jdk1.7.0_45\jre\lib\security>keytool -importcert -trustcacerts -file PathToCert -alias ca_alias -keystore "C:\Program Files\Java\jdk1.7.0_45\jre\lib\security\cacerts"
But without success. Here is the procedure to get tweets:
public static void main(String[] args) throws TwitterException {
ConfigurationBuilder cb = new ConfigurationBuilder();
cb.setDebugEnabled(true)
.setOAuthConsumerKey("myConsumerKey")
.setOAuthConsumerSecret("myConsumerSecret")
.setOAuthAccessToken("myAccessToken")
.setOAuthAccessTokenSecret("myAccessTokenSecret");
TwitterFactory tf = new TwitterFactory(cb.build());
Twitter twitter = tf.getInstance();
try {
Query query = new Query("iphone");
QueryResult result;
result = twitter.search(query);
System.out.println("Total amount of tweets: " + result.getTweets().size());
List<Status> tweets = result.getTweets();
for (Status tweet : tweets) {
System.out.println("#" + tweet.getUser().getScreenName() + " : " + tweet.getText());
}
} catch (TwitterException te) {
te.printStackTrace();
System.out.println("Failed to search tweets: " + te.getMessage());
}
And here is the error:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Relevant discussions can be found on the Internet at:
http://www.google.co.jp/search?q=d35baff5 or
http://www.google.co.jp/search?q=1446302e
TwitterException{exceptionCode=[d35baff5-1446302e 43208640-747fd158 43208640-747fd158 43208640-747fd158], statusCode=-1, message=null, code=-1, retryAfter=-1, rateLimitStatus=null, version=3.0.5}
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:177)
at twitter4j.internal.http.HttpClientWrapper.request(HttpClientWrapper.java:61)
at twitter4j.internal.http.HttpClientWrapper.get(HttpClientWrapper.java:81)
at twitter4j.TwitterImpl.get(TwitterImpl.java:1929)
at twitter4j.TwitterImpl.search(TwitterImpl.java:306)
at jku.cc.servlets.TweetsAnalyzer.main(TweetsAnalyzer.java:38)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at twitter4j.internal.http.HttpResponseImpl.<init>(HttpResponseImpl.java:34)
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:141)
... 5 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 20 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 26 more
Failed to search tweets: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Go to URL in your browser:
firefox - click on HTTPS certificate chain (the lock icon right next to URL address). Click "more info" > "security" > "show certificate" > "details" > "export..". Pickup the name and choose file type example.cer
chrome - click on site icon left to address in address bar, select "Certificate" -> "Details" -> "Export" and save in format "Der-encoded binary, single certificate".
Now you have file with keystore and you have to add it to your JVM. Determine location of cacerts files, eg.
C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts.
Next import the example.cer file into cacerts in command line (may need administrator command prompt):
keytool -import -alias example -keystore "C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts" -file example.cer
You will be asked for password which default is changeit
Restart your JVM/PC.
source:
http://magicmonster.com/kb/prg/java/ssl/pkix_path_building_failed.html
After many hours trying to build cert files to get my Java 6 installation working with the new twitter cert's, I finally stumbled onto an incredibly simple solution buried in a comment in one of the message boards. Just copy the cacerts file from a Java 7 installation and overwrite the one in your Java 6 installation. Probably best to make a backup of the cacerts file first, but then you just copy the new one in and BOOM! it just works.
Note that I actually copied a Windows cacerts file onto a Linux installation and it worked just fine.
The file is located in jre/lib/security/cacerts in both the old and new Java jdk installations.
Hope this saves someone else hours of aggravation.
MY UI approach:
Download keystore explorer from here
Open $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
Import your .crt file
CMD-Line:
keytool -importcert -file jetty.crt -alias jetty -keystore $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
1. Check the certificate
Try to load the target URL in browser and view the site's certificate (usually it's accessible by the icon with the lock sign. It's on the left or right side of the browser's address bar) whether it's expired or untrusted by other reason.
2. Install latest versions of JRE and JDK
New versions usually come with the updated set of the trusted certificates.
Also if it's possible, uninstall old versions. This will make misconfiguration errors explicit.
3. Check your configuration:
Check where your JAVA_HOME environment variable points to.
Check which java version you use to run the program. In IntelliJ check:
File -> Project Structure... -> Project Settings -> Project -> Project SDK:
File -> Project Structure... -> Platform Settings -> SDKs
4. Copy whole keystore from the new Java version
If you develop under the JDK other than the latest available - try to replace the %JAVA_HOME%/jre/lib/security/cacerts file with the new one from the latest installed JRE (make a backup copy first) as #jeremy-goodell suggests in his answer
5. Add certificate(s) to your keystore
If nothing above solves your problem use keytool to save certificate(s) to the Java's keystore:
keytool -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit -importcert -alias <alias_name> -file <path_to_crt_file>
File with the certificate can be obtained from the browser as #MagGGG suggests in his answer.
Note 1: you may need to repeat this for every certificate in the chain to you site's certificate. Start from the root one.
Note 2: <alias_name> should be unique among the keys in the store or keytool will show an error.
To get list of all the certificates in the store you may run:
keytool -list -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
In case something goes wrong this will help you to remove certificate from the store:
keytool -delete -alias <alias_name> -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
-Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true
It is used for jump the certificate validation.
Warning!
Only use for development purposes for this is unsecure!
I have stumbled upon this issue which took many hours of research to fix, specially with auto-generated certificates, which unlike Official ones, are quite tricky and Java does not like them that much.
Please check the following link: Solve Problem with certificates in Java
Basically you have to add the certificate from the server to the Java Home certs.
Generate or Get your certificate and configure Tomcat to use it in Servers.xml
Download the Java source code of the class InstallCert and execute it while the server is running, providing the following arguments server[:port]. No password is needed, as the original password works for the Java certs ("changeit").
The Program will connect to the server and Java will throw an exception, it will analyze the certificate provided by the server and allow you to create a jssecerts file inside the directory where you executed the Program (If executed from Eclipse then make sure you configure the Work directory in Run -> Configurations).
Manually copy that file to $JAVA_HOME/jre/lib/security
After following these steps, the connections with the certificate will not generate exceptions anymore within Java.
The following source code is important and it disappeared from (Sun) Oracle blogs, the only page I found it was on the link provided, therefore I am attaching it in the answer for any reference.
/*
* Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* - Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* - Neither the name of Sun Microsystems nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* Originally from:
* http://blogs.sun.com/andreas/resource/InstallCert.java
* Use:
* java InstallCert hostname
* Example:
*% java InstallCert ecc.fedora.redhat.com
*/
import javax.net.ssl.*;
import java.io.*;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
/**
* Class used to add the server's certificate to the KeyStore
* with your trusted certificates.
*/
public class InstallCert {
public static void main(String[] args) throws Exception {
String host;
int port;
char[] passphrase;
if ((args.length == 1) || (args.length == 2)) {
String[] c = args[0].split(":");
host = c[0];
port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
String p = (args.length == 1) ? "changeit" : args[1];
passphrase = p.toCharArray();
} else {
System.out.println("Usage: java InstallCert [:port] [passphrase]");
return;
}
File file = new File("jssecacerts");
if (file.isFile() == false) {
char SEP = File.separatorChar;
File dir = new File(System.getProperty("java.home") + SEP
+ "lib" + SEP + "security");
file = new File(dir, "jssecacerts");
if (file.isFile() == false) {
file = new File(dir, "cacerts");
}
}
System.out.println("Loading KeyStore " + file + "...");
InputStream in = new FileInputStream(file);
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, passphrase);
in.close();
SSLContext context = SSLContext.getInstance("TLS");
TrustManagerFactory tmf =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);
X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
context.init(null, new TrustManager[]{tm}, null);
SSLSocketFactory factory = context.getSocketFactory();
System.out.println("Opening connection to " + host + ":" + port + "...");
SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
socket.setSoTimeout(10000);
try {
System.out.println("Starting SSL handshake...");
socket.startHandshake();
socket.close();
System.out.println();
System.out.println("No errors, certificate is already trusted");
} catch (SSLException e) {
System.out.println();
e.printStackTrace(System.out);
}
X509Certificate[] chain = tm.chain;
if (chain == null) {
System.out.println("Could not obtain server certificate chain");
return;
}
BufferedReader reader =
new BufferedReader(new InputStreamReader(System.in));
System.out.println();
System.out.println("Server sent " + chain.length + " certificate(s):");
System.out.println();
MessageDigest sha1 = MessageDigest.getInstance("SHA1");
MessageDigest md5 = MessageDigest.getInstance("MD5");
for (int i = 0; i < chain.length; i++) {
X509Certificate cert = chain[i];
System.out.println
(" " + (i + 1) + " Subject " + cert.getSubjectDN());
System.out.println(" Issuer " + cert.getIssuerDN());
sha1.update(cert.getEncoded());
System.out.println(" sha1 " + toHexString(sha1.digest()));
md5.update(cert.getEncoded());
System.out.println(" md5 " + toHexString(md5.digest()));
System.out.println();
}
System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
String line = reader.readLine().trim();
int k;
try {
k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
} catch (NumberFormatException e) {
System.out.println("KeyStore not changed");
return;
}
X509Certificate cert = chain[k];
String alias = host + "-" + (k + 1);
ks.setCertificateEntry(alias, cert);
OutputStream out = new FileOutputStream("jssecacerts");
ks.store(out, passphrase);
out.close();
System.out.println();
System.out.println(cert);
System.out.println();
System.out.println
("Added certificate to keystore 'jssecacerts' using alias '"
+ alias + "'");
}
private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();
private static String toHexString(byte[] bytes) {
StringBuilder sb = new StringBuilder(bytes.length * 3);
for (int b : bytes) {
b &= 0xff;
sb.append(HEXDIGITS[b >> 4]);
sb.append(HEXDIGITS[b & 15]);
sb.append(' ');
}
return sb.toString();
}
private static class SavingTrustManager implements X509TrustManager {
private final X509TrustManager tm;
private X509Certificate[] chain;
SavingTrustManager(X509TrustManager tm) {
this.tm = tm;
}
public X509Certificate[] getAcceptedIssuers() {
throw new UnsupportedOperationException();
}
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
throw new UnsupportedOperationException();
}
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
this.chain = chain;
tm.checkServerTrusted(chain, authType);
}
}
}
Mac
The accepted answer does not work for Mac as there is no Export button available in Mac (Chrome or Firefox). Please check this answer to download the certificate and follow the next steps as mentioned below:
List all certificates installed in the keystore:
cd $JAVA_HOME/lib/security
keytool -list -keystore cacerts
Notes:
The default password of the keystore is: changeit.
For Java-8 or lower version use the command, cd $JAVA_HOME/jre/lib/security
Before you import the certificate in the keystore, make a backup of the keystore:
sudo cp cacerts cacerts.bak
Import the downloaded certificate in the keystore:
sudo keytool -importcert -alias youralias -file /path/to/the/downloaded/certificate -keystore cacerts
Check if the certificate is stored in the keystore:
sudo keytool -list -keystore cacerts -alias youralias
If you want to see more detailed information, add the -v flag:
sudo keytool -v -list -keystore cacerts -alias youralias
I wanted to import certificate for smtp.gmail.com. The only solution that worked for me is
Enter command to view this certificate
D:\openssl\bin\openssl.exe s_client -connect smtp.gmail.com:465
Copy and save the lines between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- into a file, gmail.cer
Run
keytool -import -alias smtp.gmail.com -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -file C:\Users\Admin\Desktop\gmail.cer
Enter password: changeit
Click "Yes" to import the certificate
Restart Java
Now run the command and you are good to go.
I had a slightly different situation, when both JDK and JRE 1.8.0_112 were present on my system.
I imported the new CA certificates into [JDK_FOLDER]\jre\lib\security\cacerts using the already known command:
keytool -import -trustcacerts -keystore cacerts -alias <new_ca_alias> -file <path_to_ca_cert_file>
Still, I kept getting the same PKIX path building failed error.
I added debug information to the java CLI, by using java -Djavax.net.debug=all ... > debug.log. In the debug.log file, the line that begins with trustStore is: actually pointed to the cacerts store found in [JRE_FOLDER]\lib\security\cacerts.
In my case the solution was to copy the cacerts file used by JDK (which had the new CAs added) over the one used by the JRE and that fixed the issue.
This isn't a Twitter-specific answer, but this is the question that comes up when you search for this error. If your system is receiving this error when connecting to a website that appears to have a valid certificate when viewed in a web browser, that probably means that website has an incomplete certificate chain.
For a brief summary of the problem: Certificate Authorities don't use their Root Certificate to sign just any old certificate. Instead, they (usually) sign intermediate certificates that also have the Certificate Authority flag set (that is, are allowed to sign certificates). Then when you purchase a certificate from a CA, they sign your CSR with one of these intermediate certificates.
Your Java trust store most likely only has the Root Cert, not the intermediate ones.
A misconfigured site might return just their signed cert. Problem: it was signed with an intermediate cert that's not in your trust store. Browsers will handle this problem by downloading or using a cached intermediate certificate; this maximizes website compatibility. Java and tools like OpenSSL, however, won't. And that will cause the error in the question.
You can verify this suspicion by using the Qualys SSL Test. If you run that against a site and it says
This server's certificate chain is incomplete.
then that confirms it. You can also see this by looking at the certification paths and seeing the text Extra Download.
How to fix it: the server administrator needs to configure the web server to return the intermediate certificates as well. For Comodo, for example, this is where the .ca-bundle file comes in handy. For example, in an Apache configuration with mod_ssl, you'd use the SSLCertificateChainFile configuration setting. For nginx, you need to concatenate the intermediate certificates and the signed certificate and use that in the SSL cert configuration. You can find more by searching for "incomplete certificate chain" online.
Issue Background:
I was getting following error when i try to run mvn clean install in my project and through Netbeans IDE clean and build option.
This issue is due to certificate not available when we download through NET beans IDE/through command prompt, but able to download the files through the browser.
Error:
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact com.java.project:product:jar:1.0.32 from/to repo-local (https://url/local-repo): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Resolution:
1. Download the certificate of the Url in question:
Launch IE by "run as adminstrator" (otherwise, we will not be able to download the certificate)
Enter the url in IE-> https://url/local-repo
(In my case this url had a untrusted certificate.)
Download the certificate by clicking on Certificate error -> view certificate
Select Details tab -> copy to file -> next -> select "DER encoded binary X.509 (.CER)
save the certificate in some location, example : c:/user/sheldon/desktop/product.cer
Congrats! you have successfully downloaded the certificate for the site
2. Now install the key store to fix the issue.
Run the keytool command to append the downloaded keystore into the
existing certificate file.
Command: Below command in the bin folder of jdk (JAVA_HOME).
C:\Program Files\Java\jdk1.8.0_141\jre\bin>keytool -importcert -file
"C:/user/sheldon/desktop/product.cer" -alias product -keystore
"C:/Program Files/Java/jdk1.8.0_141/jre/lib/security/cacerts".
You will be prompted to enter password. Enter keystore password:
enter "changeit" again for "Trust this certificate? [no]:", enter
"yes"
Sample command line commands/output:
keytool -importcert -file "C:/Users/sheldon/Desktop/product.cer" -alias product -keystore "C:/Program iles/Java/jdk1.8.0_141/jre/lib/security/cacerts"
Enter keystore password:
Trust this certificate? [no]: yes
Certificate was added to keystore
Contgrats! now you should have got rid of "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException" error in your Netbeans IDE.
This is a solution but in form of my story with this problem:
I was almost dead trying all the solutions given above(for 3 days ) and nothing worked for me.
I lost all hope.
I contacted my security team regarding this because I was behind a proxy and they told me that they had recently updated their security policy.
Later they issued a new "cacerts" file which contains all the certificates.
I removed the cacerts file which is present inside %JAVA_HOME%/jre/lib/security and it solved my problem.
So if you are facing this issue it might be from your network team also like this.
After struggling for half-day, found one more way to solve this problem. I was able to solve this in MAC 10.15.5 ( Catalina). Followed the below steps.
This problem occurs when we are running behind a company proxy , In my case its Zscaler.
Open Key chain access, export CA certificate.(Select CA certificate, File->export items and save with the desired name)
Copy the path of existing cacerts from java folder(/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
)
Open terminal and navigate to the Keytool folder (/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/bin
)
Run the below command.
Keytool -importcert - file (Path to exported cert from the keychainaccess) -alias (give a name) -keystore (Path of existing cacerts from java folder)
sudo Keytool -importcert -file /Users/Desktop/RootCA.cer -alias demo -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
It will ask for password , give it as : changeit
It asks for confirmation , Say : yes
After all of these steps, Quit eclipse and terminal start fresh session.
The reason, we get above error is that JDK is bundled with a lot of trusted Certificate Authority(CA) certificates into a file called ‘cacerts’ but this file has no clue of our self-signed certificate. In other words, the cacerts file doesn’t have our self-signed certificate imported and thus doesn’t treat it as a trusted entity and hence it gives the above error.
How to fix the above error
To fix the above error, all we need is to import the self-signed certificate into the cacerts file.
First, locate the cacerts file. We will need to find out the JDK location. If you are running your application through one of the IDE’s like Eclipse or IntelliJ Idea go to project settings and figure out what is the JDK location.
For e.g on a Mac OS typical location of cacerts file would be at this location /Library/Java/JavaVirtualMachines/ {{JDK_version}}/Contents/Home/jre/lib/security
on a Window’s machine it would be under {{Installation_directory}}/{{JDK_version}}/jre/lib/security
Once you have located the cacerts file, now we need to import our self-signed certificate to this cacerts file. Check the last article, if you don’t know how to generate the self-signed certificate correctly.
If you don’t have a certificate file(.crt) and just have a .jks file you can generate a .crt file by using below command. In case you already have a .crt/.pem file then you can ignore below command
##To generate certificate from keystore(.jks file) ####
keytool -export -keystore keystore.jks -alias selfsigned -file selfsigned.crt
Above step will generate a file called selfsigned.crt.Now Import the certificate to cacerts
Now add the certificate to JRE/lib/security/cacerts (trustore)
keytool -importcert -file selfsigned.crt -alias selfsigned -keystore {{cacerts path}}
for e.g
keytool -importcert -file selfsigned.nextgen.crt -alias selfsigned.nextgen -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_171.jdk/Contents/Home/jre/lib/security/cacerts
That’s all, restart your application and it should work fine. If it still doesn’t work and get an SSL handshake exception. It probably means you are using different domain then registered in the certificate.
The Link with detailed explanation and step by step resolution is over here.
I was facing the same issue and get it resolved using the below simple steps:
1) Download the InstallCert.java from google
2) Compile it using javac InstallCert.java
3) Run InstallCert.java using java InstallCert.java, with the hostname and https port, and press “1” when asking for input. It will add the “localhost” as a trusted keystore, and generate a file named “jssecacerts“ as below:
java InstallCert localhost:443
4) copy the jssecacerts into $JAVA_HOME/jre/lib/security folder
Main source to resolve the issue here is:
https://ankurjain26.blogspot.in/2017/11/javaxnetsslsslhandshakeexception.html
Problem is, your eclipse is not able to connect the site which actually it is trying to.
I have faced similar issue and below given solution worked for me.
Turn off any third party internet security application e.g. Zscaler
Sometimes also need to disconnect VPN if you are connected.
Thanks
Adding cacerts did not work for me.
After enabling log with flag -Djavax.net.debug=all, then came to know java reading from jssecacerts.
Import to jssecacerts worked finally.
For me, certificate error popped up because I had fiddler running in background and that messes up with certificate. It acts as a proxy so close that and restart eclipse.
I came across this question while trying to install the Cucumber-Eclipse plugin in Eclipse via their update site. I received the same SunCertPathBuilderException error:
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
While some of the other answers are appropriate and helpful for this question's given situation, they were nevertheless unhelpful and misleading for my issue.
In my case, the issue was that the URL provided for their update site is:
https://cucumber.io/cucumber-eclipse/update-site
However when navigating to it via a browser, it redirected to (note the added ".github"):
http://cucumber.github.io/cucumber-eclipse/update-site/
So the resolution is to simply use the redirected version of the update site URL when adding the update site in eclipse.
goals:
use https connections
verify SSL chains
do not deal with cacerts
add certificate in runtime
do not lose certificates from cacerts
How to do it:
define own keystore
put certificate into keystore
redefine SSL default context with our custom class
???
profit
My Keystore wrapper file:
public class CertificateManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private String keyStoreLocation;
private String keyStorePassword;
private X509TrustManager myTrustManager;
private static KeyStore myTrustStore;
public CertificateManager(String keyStoreLocation, String keyStorePassword) throws Exception {
this.keyStoreLocation = keyStoreLocation;
this.keyStorePassword = keyStorePassword;
myTrustStore = createKeyStore(keyStoreLocation, keyStorePassword);
}
public void addCustomCertificate(String certFileName, String certificateAlias)
throws Exception {
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null);
Certificate certificate = myTrustStore.getCertificate(certificateAlias);
if (certificate == null) {
logger.info("Certificate not exists");
addCertificate(certFileName, certificateAlias);
} else {
logger.info("Certificate exists");
}
tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(myTrustStore);
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
setMytrustManager((X509TrustManager) tm);
logger.info("Trust manager found");
break;
}
}
}
private InputStream fullStream(String fname) throws IOException {
ClassLoader classLoader = getClass().getClassLoader();
InputStream resource = classLoader.getResourceAsStream(fname);
try {
if (resource != null) {
DataInputStream dis = new DataInputStream(resource);
byte[] bytes = new byte[dis.available()];
dis.readFully(bytes);
return new ByteArrayInputStream(bytes);
} else {
logger.info("resource not found");
}
} catch (Exception e) {
logger.error("exception in certificate fetching as resource", e);
}
return null;
}
public static KeyStore createKeyStore(String keystore, String pass) throws Exception {
try {
InputStream in = CertificateManager.class.getClass().getResourceAsStream(keystore);
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(in, pass.toCharArray());
logger.info("Keystore was created from resource file");
return keyStore;
} catch (Exception e) {
logger.info("Fail to create keystore from resource file");
}
File file = new File(keystore);
KeyStore keyStore = KeyStore.getInstance("JKS");
if (file.exists()) {
keyStore.load(new FileInputStream(file), pass.toCharArray());
logger.info("Default keystore loaded");
} else {
keyStore.load(null, null);
keyStore.store(new FileOutputStream(file), pass.toCharArray());
logger.info("New keystore created");
}
return keyStore;
}
private void addCertificate(String certFileName, String certificateAlias) throws CertificateException,
IOException, KeyStoreException, NoSuchAlgorithmException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream certStream = fullStream(certFileName);
Certificate certs = cf.generateCertificate(certStream);
myTrustStore.setCertificateEntry(certificateAlias, certs);
FileOutputStream out = new FileOutputStream(getKeyStoreLocation());
myTrustStore.store(out, getKeyStorePassword().toCharArray());
out.close();
logger.info("Certificate pushed");
}
public String getKeyStoreLocation() {
return keyStoreLocation;
}
public String getKeyStorePassword() {
return keyStorePassword;
}
public X509TrustManager getMytrustManager() {
return myTrustManager;
}
public void setMytrustManager(X509TrustManager myTrustManager) {
this.myTrustManager = myTrustManager;
}
}
This class will create keystore if necessary, and will be able to manage certificates inside of it. Now class for SSL context:
public class CustomTrustManager implements X509TrustManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private static SSLSocketFactory socketFactory;
private static CustomTrustManager instance = new CustomTrustManager();
private static List<CertificateManager> register = new ArrayList<>();
public static CustomTrustManager getInstance() {
return instance;
}
private X509TrustManager defaultTm;
public void register(CertificateManager certificateManager) {
for(CertificateManager manager : register) {
if(manager == certificateManager) {
logger.info("Certificate manager already registered");
return;
}
}
register.add(certificateManager);
logger.info("New Certificate manager registered");
}
private CustomTrustManager() {
try {
String algorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
tmf.init((KeyStore) null);
boolean found = false;
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
defaultTm = (X509TrustManager) tm;
found = true;
break;
}
}
if(found) {
logger.info("Default trust manager found");
} else {
logger.warn("Default trust manager was not found");
}
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[]{this}, null);
SSLContext.setDefault(sslContext);
socketFactory = sslContext.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);
logger.info("Custom trust manager was set");
} catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
logger.warn("Custom trust manager can't be set");
e.printStackTrace();
}
}
#Override
public X509Certificate[] getAcceptedIssuers() {
List<X509Certificate> out = new ArrayList<>();
if (defaultTm != null) {
out.addAll(Arrays.asList(defaultTm.getAcceptedIssuers()));
}
int defaultCount = out.size();
logger.info("Default trust manager contain " + defaultCount + " certficates");
for(CertificateManager manager : register) {
X509TrustManager customTrustManager = manager.getMytrustManager();
X509Certificate[] issuers = customTrustManager.getAcceptedIssuers();
out.addAll(Arrays.asList(issuers));
}
logger.info("Custom trust managers contain " + (out.size() - defaultCount) + " certficates");
X509Certificate[] arrayOut = new X509Certificate[out.size()];
return out.toArray(arrayOut);
}
#Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by custom trust manager");
return;
} catch (Exception e) {
}
}
if (defaultTm != null) {
defaultTm.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by default trust manager");
} else {
logger.info("Certificate chain (server) was rejected");
throw new CertificateException("Can't check server trusted certificate.");
}
}
#Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
try {
if (defaultTm != null) {
defaultTm.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by default trust manager");
} else {
throw new NullPointerException();
}
} catch (Exception e) {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by custom trust manager");
return;
} catch (Exception e1) {
}
}
logger.info("Certificate chain (client) was rejected");
throw new CertificateException("Can't check client trusted certificate.");
}
}
public SSLSocketFactory getSocketFactory() {
return socketFactory;
}
}
This class made as singleton, because only one defaultSSL context allowed. So, now usage:
CertificateManager certificateManager = new CertificateManager("C:\\myapplication\\mykeystore.jks", "changeit");
String certificatePath = "C:\\myapplication\\public_key_for_your_ssl_service.crt";
try {
certificateManager.addCustomCertificate(certificatePath, "alias_for_public_key_for_your_ssl_service");
} catch (Exception e) {
log.error("Can't add custom certificate");
e.printStackTrace();
}
CustomTrustManager.getInstance().register(certificateManager);
Possibly, it will not work with this settings, because I keep certificate file inside of resource folder, so my path is not absolute. But generally, it work perfectly.
If your repository URL also work on HTTP and the security is not a concern, you can go to settings.xml (often, but not always, located in %USERPROFILE%/.m2) and replace HTTPS with HTTP for <repository> and <pluginRepository> URLs.
For example, this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
should be replaced by this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
I was using my own trust store rather than JRE one by passing arg -Djavax.net.ssl.trustStore=
I was getting this error regardless of certs in truststore. The issue for me was the ordering of of the properties passed on arg line.
When i put -Djavax.net.ssl.trustStore=& -Djavax.net.ssl.trustStorePassword= before -Dspring.config.location= & -jar args i was able to successfully invoke my rest call over https.
I solved this issue on Windows Server 2016 with Java 8, by importing cert from pkcs12 store to cacerts keystore.
Path to pkcs12 store:
C:\Apps\pkcs12.pfx
Path to Java cacerts:
C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts
Path to keytool:
C:\Program Files\Java\jre1.8.0_151\bin
After possitioning to folder with keytool in command prompt (as administrator), command to import cert from pkcs12 to cacerts is as follows:
keytool -v -importkeystore -srckeystore C:\Apps\pkcs12.pfx -srcstoretype PKCS12 -destkeystore "C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts" -deststoretype JKS
You will be prompted to:
1. enter destination keystore password (cacerts pasword, default is "changeit")
2. enter source keystore password (pkcs12 password)
For changes to take effect, restart server machine (or just restart JVM).
I ran into same issue but updating wrong jre on my linux machine. It is highly likely that tomcat is using different jre and your cli prompt is configured to use a different jre.
Make sure you are picking up the correct jre.
Step #1:
ps -ef | grep tomcat
You will see some thing like:
root 29855 1 3 17:54 pts/3 00:00:42 /usr/java/jdk1.7.0_79/jre/bin/java
Now use this:
keytool -import -alias example -keystore /usr/java/jdk1.7.0_79/jre/lib/security/cacerts -file cert.cer
PWD: changeit
*.cer file can be geneated as shown below: (or you can use your own)
openssl x509 -in cert.pem -outform pem -outform der -out cert.cer
If you are still getting this error
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target
after executing the below command and restarting the java process
keytool -import -alias certificatealias -keystore C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts -file certificate.cer
Then there is some issue in JDK. Try to install JDK from a trusted provider.
Once you reinstalled it from trusted provider you won't face this issue.
Simple Steps to resolve this Exception, (I did it on java 11),
First you need to Download the public SSL certificate file of the target domain that you are trying to call,for that
Open the target domain website in the chrome (Example: https://amazonservice.domain.com)
Click on the small lock icon before the URL in the browser
Click View certificates
Now Click on Certificate is valid as shown below
Now a new Popup will open as shown below,
Open the details tab
Select the RootCert at the top
Click Export and save the .cer file to your system in a directory
Now you have the public keystore of your target domain which you are trying to call in your java application,now we need to impot that keystore into you jre,for that go to the $JAVA_HOME/bin directory and run the following command
./keytool -importcert -alias someAliasName -keystore {JAVA_HOME}/lib/security/cacerts -file {PathToDownloads}/certificateFileName.cer
It will ask you for password, enter the password if you know, the default password for the certificate is changeit
References
https://confluence.atlassian.com/kb/how-to-import-a-public-ssl-certificate-into-a-jvm-867025849.html
https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html
In case your host sits behind firewall/proxy , use following command in cmd:
keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>
Replace <proxy_hostname> and <proxy_port> with the HTTP proxy server that is configured. Replace <remote_host_name:remote_ssl_port> with one of the remote host (basically url) and port having the certification problem.
Take the last certificate content printed and copy it (also copy begin and end certificate). Paste it in text file and give .crt extension to it . Now import this certificate to cacerts using java keytool command and it should work .
keytool -importcert -file <filename>.crt -alias randomaliasname -keystore %JAVA_HOME%/jre/lib/security/cacerts -storepass changeit
1-First of all, import you'r crt file into {JAVA_HOME}/jre/security/cacerts, if you still faced with this exception, change you'r jdk version. For example from jdk1.8.0_17 to jdk1.8.0_231
I was facing this issue with Java 8 but it got solved after upgrading to Java 11
Here normally this kind of exception occurs when there is mismatch in the PATH of trusted certificate. Check the configuration or path where this server certificate is required for secured communication.
I'm trying to get tweets using twitter4j library for my java project which uses under the covers java.net.HttpURLConnection (as can be seen in stack trace). On my first run I got an error about certificate sun.security.validator.ValidatorException and sun.security.provider.certpath.SunCertPathBuilderException. Then I added twitter certificate by:
C:\Program Files\Java\jdk1.7.0_45\jre\lib\security>keytool -importcert -trustcacerts -file PathToCert -alias ca_alias -keystore "C:\Program Files\Java\jdk1.7.0_45\jre\lib\security\cacerts"
But without success. Here is the procedure to get tweets:
public static void main(String[] args) throws TwitterException {
ConfigurationBuilder cb = new ConfigurationBuilder();
cb.setDebugEnabled(true)
.setOAuthConsumerKey("myConsumerKey")
.setOAuthConsumerSecret("myConsumerSecret")
.setOAuthAccessToken("myAccessToken")
.setOAuthAccessTokenSecret("myAccessTokenSecret");
TwitterFactory tf = new TwitterFactory(cb.build());
Twitter twitter = tf.getInstance();
try {
Query query = new Query("iphone");
QueryResult result;
result = twitter.search(query);
System.out.println("Total amount of tweets: " + result.getTweets().size());
List<Status> tweets = result.getTweets();
for (Status tweet : tweets) {
System.out.println("#" + tweet.getUser().getScreenName() + " : " + tweet.getText());
}
} catch (TwitterException te) {
te.printStackTrace();
System.out.println("Failed to search tweets: " + te.getMessage());
}
And here is the error:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Relevant discussions can be found on the Internet at:
http://www.google.co.jp/search?q=d35baff5 or
http://www.google.co.jp/search?q=1446302e
TwitterException{exceptionCode=[d35baff5-1446302e 43208640-747fd158 43208640-747fd158 43208640-747fd158], statusCode=-1, message=null, code=-1, retryAfter=-1, rateLimitStatus=null, version=3.0.5}
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:177)
at twitter4j.internal.http.HttpClientWrapper.request(HttpClientWrapper.java:61)
at twitter4j.internal.http.HttpClientWrapper.get(HttpClientWrapper.java:81)
at twitter4j.TwitterImpl.get(TwitterImpl.java:1929)
at twitter4j.TwitterImpl.search(TwitterImpl.java:306)
at jku.cc.servlets.TweetsAnalyzer.main(TweetsAnalyzer.java:38)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at twitter4j.internal.http.HttpResponseImpl.<init>(HttpResponseImpl.java:34)
at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:141)
... 5 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 20 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 26 more
Failed to search tweets: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Go to URL in your browser:
firefox - click on HTTPS certificate chain (the lock icon right next to URL address). Click "more info" > "security" > "show certificate" > "details" > "export..". Pickup the name and choose file type example.cer
chrome - click on site icon left to address in address bar, select "Certificate" -> "Details" -> "Export" and save in format "Der-encoded binary, single certificate".
Now you have file with keystore and you have to add it to your JVM. Determine location of cacerts files, eg.
C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts.
Next import the example.cer file into cacerts in command line (may need administrator command prompt):
keytool -import -alias example -keystore "C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts" -file example.cer
You will be asked for password which default is changeit
Restart your JVM/PC.
source:
http://magicmonster.com/kb/prg/java/ssl/pkix_path_building_failed.html
After many hours trying to build cert files to get my Java 6 installation working with the new twitter cert's, I finally stumbled onto an incredibly simple solution buried in a comment in one of the message boards. Just copy the cacerts file from a Java 7 installation and overwrite the one in your Java 6 installation. Probably best to make a backup of the cacerts file first, but then you just copy the new one in and BOOM! it just works.
Note that I actually copied a Windows cacerts file onto a Linux installation and it worked just fine.
The file is located in jre/lib/security/cacerts in both the old and new Java jdk installations.
Hope this saves someone else hours of aggravation.
MY UI approach:
Download keystore explorer from here
Open $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
Import your .crt file
CMD-Line:
keytool -importcert -file jetty.crt -alias jetty -keystore $JAVA_HOME/jre/lib/security/cacerts
enter PW: changeit (Can be changeme on Mac)
1. Check the certificate
Try to load the target URL in browser and view the site's certificate (usually it's accessible by the icon with the lock sign. It's on the left or right side of the browser's address bar) whether it's expired or untrusted by other reason.
2. Install latest versions of JRE and JDK
New versions usually come with the updated set of the trusted certificates.
Also if it's possible, uninstall old versions. This will make misconfiguration errors explicit.
3. Check your configuration:
Check where your JAVA_HOME environment variable points to.
Check which java version you use to run the program. In IntelliJ check:
File -> Project Structure... -> Project Settings -> Project -> Project SDK:
File -> Project Structure... -> Platform Settings -> SDKs
4. Copy whole keystore from the new Java version
If you develop under the JDK other than the latest available - try to replace the %JAVA_HOME%/jre/lib/security/cacerts file with the new one from the latest installed JRE (make a backup copy first) as #jeremy-goodell suggests in his answer
5. Add certificate(s) to your keystore
If nothing above solves your problem use keytool to save certificate(s) to the Java's keystore:
keytool -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit -importcert -alias <alias_name> -file <path_to_crt_file>
File with the certificate can be obtained from the browser as #MagGGG suggests in his answer.
Note 1: you may need to repeat this for every certificate in the chain to you site's certificate. Start from the root one.
Note 2: <alias_name> should be unique among the keys in the store or keytool will show an error.
To get list of all the certificates in the store you may run:
keytool -list -trustcacerts -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
In case something goes wrong this will help you to remove certificate from the store:
keytool -delete -alias <alias_name> -keystore "%JAVA_HOME%jre\lib\security\cacerts" -storepass changeit
-Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true
It is used for jump the certificate validation.
Warning!
Only use for development purposes for this is unsecure!
I have stumbled upon this issue which took many hours of research to fix, specially with auto-generated certificates, which unlike Official ones, are quite tricky and Java does not like them that much.
Please check the following link: Solve Problem with certificates in Java
Basically you have to add the certificate from the server to the Java Home certs.
Generate or Get your certificate and configure Tomcat to use it in Servers.xml
Download the Java source code of the class InstallCert and execute it while the server is running, providing the following arguments server[:port]. No password is needed, as the original password works for the Java certs ("changeit").
The Program will connect to the server and Java will throw an exception, it will analyze the certificate provided by the server and allow you to create a jssecerts file inside the directory where you executed the Program (If executed from Eclipse then make sure you configure the Work directory in Run -> Configurations).
Manually copy that file to $JAVA_HOME/jre/lib/security
After following these steps, the connections with the certificate will not generate exceptions anymore within Java.
The following source code is important and it disappeared from (Sun) Oracle blogs, the only page I found it was on the link provided, therefore I am attaching it in the answer for any reference.
/*
* Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* - Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* - Neither the name of Sun Microsystems nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/**
* Originally from:
* http://blogs.sun.com/andreas/resource/InstallCert.java
* Use:
* java InstallCert hostname
* Example:
*% java InstallCert ecc.fedora.redhat.com
*/
import javax.net.ssl.*;
import java.io.*;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
/**
* Class used to add the server's certificate to the KeyStore
* with your trusted certificates.
*/
public class InstallCert {
public static void main(String[] args) throws Exception {
String host;
int port;
char[] passphrase;
if ((args.length == 1) || (args.length == 2)) {
String[] c = args[0].split(":");
host = c[0];
port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
String p = (args.length == 1) ? "changeit" : args[1];
passphrase = p.toCharArray();
} else {
System.out.println("Usage: java InstallCert [:port] [passphrase]");
return;
}
File file = new File("jssecacerts");
if (file.isFile() == false) {
char SEP = File.separatorChar;
File dir = new File(System.getProperty("java.home") + SEP
+ "lib" + SEP + "security");
file = new File(dir, "jssecacerts");
if (file.isFile() == false) {
file = new File(dir, "cacerts");
}
}
System.out.println("Loading KeyStore " + file + "...");
InputStream in = new FileInputStream(file);
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, passphrase);
in.close();
SSLContext context = SSLContext.getInstance("TLS");
TrustManagerFactory tmf =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);
X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
context.init(null, new TrustManager[]{tm}, null);
SSLSocketFactory factory = context.getSocketFactory();
System.out.println("Opening connection to " + host + ":" + port + "...");
SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
socket.setSoTimeout(10000);
try {
System.out.println("Starting SSL handshake...");
socket.startHandshake();
socket.close();
System.out.println();
System.out.println("No errors, certificate is already trusted");
} catch (SSLException e) {
System.out.println();
e.printStackTrace(System.out);
}
X509Certificate[] chain = tm.chain;
if (chain == null) {
System.out.println("Could not obtain server certificate chain");
return;
}
BufferedReader reader =
new BufferedReader(new InputStreamReader(System.in));
System.out.println();
System.out.println("Server sent " + chain.length + " certificate(s):");
System.out.println();
MessageDigest sha1 = MessageDigest.getInstance("SHA1");
MessageDigest md5 = MessageDigest.getInstance("MD5");
for (int i = 0; i < chain.length; i++) {
X509Certificate cert = chain[i];
System.out.println
(" " + (i + 1) + " Subject " + cert.getSubjectDN());
System.out.println(" Issuer " + cert.getIssuerDN());
sha1.update(cert.getEncoded());
System.out.println(" sha1 " + toHexString(sha1.digest()));
md5.update(cert.getEncoded());
System.out.println(" md5 " + toHexString(md5.digest()));
System.out.println();
}
System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
String line = reader.readLine().trim();
int k;
try {
k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
} catch (NumberFormatException e) {
System.out.println("KeyStore not changed");
return;
}
X509Certificate cert = chain[k];
String alias = host + "-" + (k + 1);
ks.setCertificateEntry(alias, cert);
OutputStream out = new FileOutputStream("jssecacerts");
ks.store(out, passphrase);
out.close();
System.out.println();
System.out.println(cert);
System.out.println();
System.out.println
("Added certificate to keystore 'jssecacerts' using alias '"
+ alias + "'");
}
private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();
private static String toHexString(byte[] bytes) {
StringBuilder sb = new StringBuilder(bytes.length * 3);
for (int b : bytes) {
b &= 0xff;
sb.append(HEXDIGITS[b >> 4]);
sb.append(HEXDIGITS[b & 15]);
sb.append(' ');
}
return sb.toString();
}
private static class SavingTrustManager implements X509TrustManager {
private final X509TrustManager tm;
private X509Certificate[] chain;
SavingTrustManager(X509TrustManager tm) {
this.tm = tm;
}
public X509Certificate[] getAcceptedIssuers() {
throw new UnsupportedOperationException();
}
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
throw new UnsupportedOperationException();
}
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
this.chain = chain;
tm.checkServerTrusted(chain, authType);
}
}
}
Mac
The accepted answer does not work for Mac as there is no Export button available in Mac (Chrome or Firefox). Please check this answer to download the certificate and follow the next steps as mentioned below:
List all certificates installed in the keystore:
cd $JAVA_HOME/lib/security
keytool -list -keystore cacerts
Notes:
The default password of the keystore is: changeit.
For Java-8 or lower version use the command, cd $JAVA_HOME/jre/lib/security
Before you import the certificate in the keystore, make a backup of the keystore:
sudo cp cacerts cacerts.bak
Import the downloaded certificate in the keystore:
sudo keytool -importcert -alias youralias -file /path/to/the/downloaded/certificate -keystore cacerts
Check if the certificate is stored in the keystore:
sudo keytool -list -keystore cacerts -alias youralias
If you want to see more detailed information, add the -v flag:
sudo keytool -v -list -keystore cacerts -alias youralias
I wanted to import certificate for smtp.gmail.com. The only solution that worked for me is
Enter command to view this certificate
D:\openssl\bin\openssl.exe s_client -connect smtp.gmail.com:465
Copy and save the lines between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- into a file, gmail.cer
Run
keytool -import -alias smtp.gmail.com -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -file C:\Users\Admin\Desktop\gmail.cer
Enter password: changeit
Click "Yes" to import the certificate
Restart Java
Now run the command and you are good to go.
I had a slightly different situation, when both JDK and JRE 1.8.0_112 were present on my system.
I imported the new CA certificates into [JDK_FOLDER]\jre\lib\security\cacerts using the already known command:
keytool -import -trustcacerts -keystore cacerts -alias <new_ca_alias> -file <path_to_ca_cert_file>
Still, I kept getting the same PKIX path building failed error.
I added debug information to the java CLI, by using java -Djavax.net.debug=all ... > debug.log. In the debug.log file, the line that begins with trustStore is: actually pointed to the cacerts store found in [JRE_FOLDER]\lib\security\cacerts.
In my case the solution was to copy the cacerts file used by JDK (which had the new CAs added) over the one used by the JRE and that fixed the issue.
This isn't a Twitter-specific answer, but this is the question that comes up when you search for this error. If your system is receiving this error when connecting to a website that appears to have a valid certificate when viewed in a web browser, that probably means that website has an incomplete certificate chain.
For a brief summary of the problem: Certificate Authorities don't use their Root Certificate to sign just any old certificate. Instead, they (usually) sign intermediate certificates that also have the Certificate Authority flag set (that is, are allowed to sign certificates). Then when you purchase a certificate from a CA, they sign your CSR with one of these intermediate certificates.
Your Java trust store most likely only has the Root Cert, not the intermediate ones.
A misconfigured site might return just their signed cert. Problem: it was signed with an intermediate cert that's not in your trust store. Browsers will handle this problem by downloading or using a cached intermediate certificate; this maximizes website compatibility. Java and tools like OpenSSL, however, won't. And that will cause the error in the question.
You can verify this suspicion by using the Qualys SSL Test. If you run that against a site and it says
This server's certificate chain is incomplete.
then that confirms it. You can also see this by looking at the certification paths and seeing the text Extra Download.
How to fix it: the server administrator needs to configure the web server to return the intermediate certificates as well. For Comodo, for example, this is where the .ca-bundle file comes in handy. For example, in an Apache configuration with mod_ssl, you'd use the SSLCertificateChainFile configuration setting. For nginx, you need to concatenate the intermediate certificates and the signed certificate and use that in the SSL cert configuration. You can find more by searching for "incomplete certificate chain" online.
Issue Background:
I was getting following error when i try to run mvn clean install in my project and through Netbeans IDE clean and build option.
This issue is due to certificate not available when we download through NET beans IDE/through command prompt, but able to download the files through the browser.
Error:
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact com.java.project:product:jar:1.0.32 from/to repo-local (https://url/local-repo): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Resolution:
1. Download the certificate of the Url in question:
Launch IE by "run as adminstrator" (otherwise, we will not be able to download the certificate)
Enter the url in IE-> https://url/local-repo
(In my case this url had a untrusted certificate.)
Download the certificate by clicking on Certificate error -> view certificate
Select Details tab -> copy to file -> next -> select "DER encoded binary X.509 (.CER)
save the certificate in some location, example : c:/user/sheldon/desktop/product.cer
Congrats! you have successfully downloaded the certificate for the site
2. Now install the key store to fix the issue.
Run the keytool command to append the downloaded keystore into the
existing certificate file.
Command: Below command in the bin folder of jdk (JAVA_HOME).
C:\Program Files\Java\jdk1.8.0_141\jre\bin>keytool -importcert -file
"C:/user/sheldon/desktop/product.cer" -alias product -keystore
"C:/Program Files/Java/jdk1.8.0_141/jre/lib/security/cacerts".
You will be prompted to enter password. Enter keystore password:
enter "changeit" again for "Trust this certificate? [no]:", enter
"yes"
Sample command line commands/output:
keytool -importcert -file "C:/Users/sheldon/Desktop/product.cer" -alias product -keystore "C:/Program iles/Java/jdk1.8.0_141/jre/lib/security/cacerts"
Enter keystore password:
Trust this certificate? [no]: yes
Certificate was added to keystore
Contgrats! now you should have got rid of "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException" error in your Netbeans IDE.
This is a solution but in form of my story with this problem:
I was almost dead trying all the solutions given above(for 3 days ) and nothing worked for me.
I lost all hope.
I contacted my security team regarding this because I was behind a proxy and they told me that they had recently updated their security policy.
Later they issued a new "cacerts" file which contains all the certificates.
I removed the cacerts file which is present inside %JAVA_HOME%/jre/lib/security and it solved my problem.
So if you are facing this issue it might be from your network team also like this.
After struggling for half-day, found one more way to solve this problem. I was able to solve this in MAC 10.15.5 ( Catalina). Followed the below steps.
This problem occurs when we are running behind a company proxy , In my case its Zscaler.
Open Key chain access, export CA certificate.(Select CA certificate, File->export items and save with the desired name)
Copy the path of existing cacerts from java folder(/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
)
Open terminal and navigate to the Keytool folder (/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/bin
)
Run the below command.
Keytool -importcert - file (Path to exported cert from the keychainaccess) -alias (give a name) -keystore (Path of existing cacerts from java folder)
sudo Keytool -importcert -file /Users/Desktop/RootCA.cer -alias demo -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts
It will ask for password , give it as : changeit
It asks for confirmation , Say : yes
After all of these steps, Quit eclipse and terminal start fresh session.
The reason, we get above error is that JDK is bundled with a lot of trusted Certificate Authority(CA) certificates into a file called ‘cacerts’ but this file has no clue of our self-signed certificate. In other words, the cacerts file doesn’t have our self-signed certificate imported and thus doesn’t treat it as a trusted entity and hence it gives the above error.
How to fix the above error
To fix the above error, all we need is to import the self-signed certificate into the cacerts file.
First, locate the cacerts file. We will need to find out the JDK location. If you are running your application through one of the IDE’s like Eclipse or IntelliJ Idea go to project settings and figure out what is the JDK location.
For e.g on a Mac OS typical location of cacerts file would be at this location /Library/Java/JavaVirtualMachines/ {{JDK_version}}/Contents/Home/jre/lib/security
on a Window’s machine it would be under {{Installation_directory}}/{{JDK_version}}/jre/lib/security
Once you have located the cacerts file, now we need to import our self-signed certificate to this cacerts file. Check the last article, if you don’t know how to generate the self-signed certificate correctly.
If you don’t have a certificate file(.crt) and just have a .jks file you can generate a .crt file by using below command. In case you already have a .crt/.pem file then you can ignore below command
##To generate certificate from keystore(.jks file) ####
keytool -export -keystore keystore.jks -alias selfsigned -file selfsigned.crt
Above step will generate a file called selfsigned.crt.Now Import the certificate to cacerts
Now add the certificate to JRE/lib/security/cacerts (trustore)
keytool -importcert -file selfsigned.crt -alias selfsigned -keystore {{cacerts path}}
for e.g
keytool -importcert -file selfsigned.nextgen.crt -alias selfsigned.nextgen -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_171.jdk/Contents/Home/jre/lib/security/cacerts
That’s all, restart your application and it should work fine. If it still doesn’t work and get an SSL handshake exception. It probably means you are using different domain then registered in the certificate.
The Link with detailed explanation and step by step resolution is over here.
I was facing the same issue and get it resolved using the below simple steps:
1) Download the InstallCert.java from google
2) Compile it using javac InstallCert.java
3) Run InstallCert.java using java InstallCert.java, with the hostname and https port, and press “1” when asking for input. It will add the “localhost” as a trusted keystore, and generate a file named “jssecacerts“ as below:
java InstallCert localhost:443
4) copy the jssecacerts into $JAVA_HOME/jre/lib/security folder
Main source to resolve the issue here is:
https://ankurjain26.blogspot.in/2017/11/javaxnetsslsslhandshakeexception.html
Problem is, your eclipse is not able to connect the site which actually it is trying to.
I have faced similar issue and below given solution worked for me.
Turn off any third party internet security application e.g. Zscaler
Sometimes also need to disconnect VPN if you are connected.
Thanks
Adding cacerts did not work for me.
After enabling log with flag -Djavax.net.debug=all, then came to know java reading from jssecacerts.
Import to jssecacerts worked finally.
For me, certificate error popped up because I had fiddler running in background and that messes up with certificate. It acts as a proxy so close that and restart eclipse.
I came across this question while trying to install the Cucumber-Eclipse plugin in Eclipse via their update site. I received the same SunCertPathBuilderException error:
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
Unable to read repository at http://cucumber.io/cucumber-eclipse/update-site/content.xml.
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
While some of the other answers are appropriate and helpful for this question's given situation, they were nevertheless unhelpful and misleading for my issue.
In my case, the issue was that the URL provided for their update site is:
https://cucumber.io/cucumber-eclipse/update-site
However when navigating to it via a browser, it redirected to (note the added ".github"):
http://cucumber.github.io/cucumber-eclipse/update-site/
So the resolution is to simply use the redirected version of the update site URL when adding the update site in eclipse.
goals:
use https connections
verify SSL chains
do not deal with cacerts
add certificate in runtime
do not lose certificates from cacerts
How to do it:
define own keystore
put certificate into keystore
redefine SSL default context with our custom class
???
profit
My Keystore wrapper file:
public class CertificateManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private String keyStoreLocation;
private String keyStorePassword;
private X509TrustManager myTrustManager;
private static KeyStore myTrustStore;
public CertificateManager(String keyStoreLocation, String keyStorePassword) throws Exception {
this.keyStoreLocation = keyStoreLocation;
this.keyStorePassword = keyStorePassword;
myTrustStore = createKeyStore(keyStoreLocation, keyStorePassword);
}
public void addCustomCertificate(String certFileName, String certificateAlias)
throws Exception {
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null);
Certificate certificate = myTrustStore.getCertificate(certificateAlias);
if (certificate == null) {
logger.info("Certificate not exists");
addCertificate(certFileName, certificateAlias);
} else {
logger.info("Certificate exists");
}
tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(myTrustStore);
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
setMytrustManager((X509TrustManager) tm);
logger.info("Trust manager found");
break;
}
}
}
private InputStream fullStream(String fname) throws IOException {
ClassLoader classLoader = getClass().getClassLoader();
InputStream resource = classLoader.getResourceAsStream(fname);
try {
if (resource != null) {
DataInputStream dis = new DataInputStream(resource);
byte[] bytes = new byte[dis.available()];
dis.readFully(bytes);
return new ByteArrayInputStream(bytes);
} else {
logger.info("resource not found");
}
} catch (Exception e) {
logger.error("exception in certificate fetching as resource", e);
}
return null;
}
public static KeyStore createKeyStore(String keystore, String pass) throws Exception {
try {
InputStream in = CertificateManager.class.getClass().getResourceAsStream(keystore);
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(in, pass.toCharArray());
logger.info("Keystore was created from resource file");
return keyStore;
} catch (Exception e) {
logger.info("Fail to create keystore from resource file");
}
File file = new File(keystore);
KeyStore keyStore = KeyStore.getInstance("JKS");
if (file.exists()) {
keyStore.load(new FileInputStream(file), pass.toCharArray());
logger.info("Default keystore loaded");
} else {
keyStore.load(null, null);
keyStore.store(new FileOutputStream(file), pass.toCharArray());
logger.info("New keystore created");
}
return keyStore;
}
private void addCertificate(String certFileName, String certificateAlias) throws CertificateException,
IOException, KeyStoreException, NoSuchAlgorithmException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream certStream = fullStream(certFileName);
Certificate certs = cf.generateCertificate(certStream);
myTrustStore.setCertificateEntry(certificateAlias, certs);
FileOutputStream out = new FileOutputStream(getKeyStoreLocation());
myTrustStore.store(out, getKeyStorePassword().toCharArray());
out.close();
logger.info("Certificate pushed");
}
public String getKeyStoreLocation() {
return keyStoreLocation;
}
public String getKeyStorePassword() {
return keyStorePassword;
}
public X509TrustManager getMytrustManager() {
return myTrustManager;
}
public void setMytrustManager(X509TrustManager myTrustManager) {
this.myTrustManager = myTrustManager;
}
}
This class will create keystore if necessary, and will be able to manage certificates inside of it. Now class for SSL context:
public class CustomTrustManager implements X509TrustManager {
private final static Logger logger = Logger.getLogger(CertificateManager.class);
private static SSLSocketFactory socketFactory;
private static CustomTrustManager instance = new CustomTrustManager();
private static List<CertificateManager> register = new ArrayList<>();
public static CustomTrustManager getInstance() {
return instance;
}
private X509TrustManager defaultTm;
public void register(CertificateManager certificateManager) {
for(CertificateManager manager : register) {
if(manager == certificateManager) {
logger.info("Certificate manager already registered");
return;
}
}
register.add(certificateManager);
logger.info("New Certificate manager registered");
}
private CustomTrustManager() {
try {
String algorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
tmf.init((KeyStore) null);
boolean found = false;
for (TrustManager tm : tmf.getTrustManagers()) {
if (tm instanceof X509TrustManager) {
defaultTm = (X509TrustManager) tm;
found = true;
break;
}
}
if(found) {
logger.info("Default trust manager found");
} else {
logger.warn("Default trust manager was not found");
}
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[]{this}, null);
SSLContext.setDefault(sslContext);
socketFactory = sslContext.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);
logger.info("Custom trust manager was set");
} catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
logger.warn("Custom trust manager can't be set");
e.printStackTrace();
}
}
#Override
public X509Certificate[] getAcceptedIssuers() {
List<X509Certificate> out = new ArrayList<>();
if (defaultTm != null) {
out.addAll(Arrays.asList(defaultTm.getAcceptedIssuers()));
}
int defaultCount = out.size();
logger.info("Default trust manager contain " + defaultCount + " certficates");
for(CertificateManager manager : register) {
X509TrustManager customTrustManager = manager.getMytrustManager();
X509Certificate[] issuers = customTrustManager.getAcceptedIssuers();
out.addAll(Arrays.asList(issuers));
}
logger.info("Custom trust managers contain " + (out.size() - defaultCount) + " certficates");
X509Certificate[] arrayOut = new X509Certificate[out.size()];
return out.toArray(arrayOut);
}
#Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by custom trust manager");
return;
} catch (Exception e) {
}
}
if (defaultTm != null) {
defaultTm.checkServerTrusted(chain, authType);
logger.info("Certificate chain (server) was aproved by default trust manager");
} else {
logger.info("Certificate chain (server) was rejected");
throw new CertificateException("Can't check server trusted certificate.");
}
}
#Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
try {
if (defaultTm != null) {
defaultTm.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by default trust manager");
} else {
throw new NullPointerException();
}
} catch (Exception e) {
for(CertificateManager certificateManager : register) {
X509TrustManager customTrustManager = certificateManager.getMytrustManager();
try {
customTrustManager.checkClientTrusted(chain, authType);
logger.info("Certificate chain (client) was aproved by custom trust manager");
return;
} catch (Exception e1) {
}
}
logger.info("Certificate chain (client) was rejected");
throw new CertificateException("Can't check client trusted certificate.");
}
}
public SSLSocketFactory getSocketFactory() {
return socketFactory;
}
}
This class made as singleton, because only one defaultSSL context allowed. So, now usage:
CertificateManager certificateManager = new CertificateManager("C:\\myapplication\\mykeystore.jks", "changeit");
String certificatePath = "C:\\myapplication\\public_key_for_your_ssl_service.crt";
try {
certificateManager.addCustomCertificate(certificatePath, "alias_for_public_key_for_your_ssl_service");
} catch (Exception e) {
log.error("Can't add custom certificate");
e.printStackTrace();
}
CustomTrustManager.getInstance().register(certificateManager);
Possibly, it will not work with this settings, because I keep certificate file inside of resource folder, so my path is not absolute. But generally, it work perfectly.
If your repository URL also work on HTTP and the security is not a concern, you can go to settings.xml (often, but not always, located in %USERPROFILE%/.m2) and replace HTTPS with HTTP for <repository> and <pluginRepository> URLs.
For example, this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
should be replaced by this:
<repository>
<snapshots>
<enabled>false</enabled>
</snapshots>
<id>central</id>
<name>libs-release</name>
<url>https://<artifactory>/libs-release</url>
</repository>
I was using my own trust store rather than JRE one by passing arg -Djavax.net.ssl.trustStore=
I was getting this error regardless of certs in truststore. The issue for me was the ordering of of the properties passed on arg line.
When i put -Djavax.net.ssl.trustStore=& -Djavax.net.ssl.trustStorePassword= before -Dspring.config.location= & -jar args i was able to successfully invoke my rest call over https.
I solved this issue on Windows Server 2016 with Java 8, by importing cert from pkcs12 store to cacerts keystore.
Path to pkcs12 store:
C:\Apps\pkcs12.pfx
Path to Java cacerts:
C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts
Path to keytool:
C:\Program Files\Java\jre1.8.0_151\bin
After possitioning to folder with keytool in command prompt (as administrator), command to import cert from pkcs12 to cacerts is as follows:
keytool -v -importkeystore -srckeystore C:\Apps\pkcs12.pfx -srcstoretype PKCS12 -destkeystore "C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts" -deststoretype JKS
You will be prompted to:
1. enter destination keystore password (cacerts pasword, default is "changeit")
2. enter source keystore password (pkcs12 password)
For changes to take effect, restart server machine (or just restart JVM).
I ran into same issue but updating wrong jre on my linux machine. It is highly likely that tomcat is using different jre and your cli prompt is configured to use a different jre.
Make sure you are picking up the correct jre.
Step #1:
ps -ef | grep tomcat
You will see some thing like:
root 29855 1 3 17:54 pts/3 00:00:42 /usr/java/jdk1.7.0_79/jre/bin/java
Now use this:
keytool -import -alias example -keystore /usr/java/jdk1.7.0_79/jre/lib/security/cacerts -file cert.cer
PWD: changeit
*.cer file can be geneated as shown below: (or you can use your own)
openssl x509 -in cert.pem -outform pem -outform der -out cert.cer
If you are still getting this error
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target
after executing the below command and restarting the java process
keytool -import -alias certificatealias -keystore C:\Program Files\Java\jre1.8.0_151\lib\security\cacerts -file certificate.cer
Then there is some issue in JDK. Try to install JDK from a trusted provider.
Once you reinstalled it from trusted provider you won't face this issue.
Simple Steps to resolve this Exception, (I did it on java 11),
First you need to Download the public SSL certificate file of the target domain that you are trying to call,for that
Open the target domain website in the chrome (Example: https://amazonservice.domain.com)
Click on the small lock icon before the URL in the browser
Click View certificates
Now Click on Certificate is valid as shown below
Now a new Popup will open as shown below,
Open the details tab
Select the RootCert at the top
Click Export and save the .cer file to your system in a directory
Now you have the public keystore of your target domain which you are trying to call in your java application,now we need to impot that keystore into you jre,for that go to the $JAVA_HOME/bin directory and run the following command
./keytool -importcert -alias someAliasName -keystore {JAVA_HOME}/lib/security/cacerts -file {PathToDownloads}/certificateFileName.cer
It will ask you for password, enter the password if you know, the default password for the certificate is changeit
References
https://confluence.atlassian.com/kb/how-to-import-a-public-ssl-certificate-into-a-jvm-867025849.html
https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html
In case your host sits behind firewall/proxy , use following command in cmd:
keytool -J-Dhttps.proxyHost=<proxy_hostname> -J-Dhttps.proxyPort=<proxy_port> -printcert -rfc -sslserver <remote_host_name:remote_ssl_port>
Replace <proxy_hostname> and <proxy_port> with the HTTP proxy server that is configured. Replace <remote_host_name:remote_ssl_port> with one of the remote host (basically url) and port having the certification problem.
Take the last certificate content printed and copy it (also copy begin and end certificate). Paste it in text file and give .crt extension to it . Now import this certificate to cacerts using java keytool command and it should work .
keytool -importcert -file <filename>.crt -alias randomaliasname -keystore %JAVA_HOME%/jre/lib/security/cacerts -storepass changeit
1-First of all, import you'r crt file into {JAVA_HOME}/jre/security/cacerts, if you still faced with this exception, change you'r jdk version. For example from jdk1.8.0_17 to jdk1.8.0_231
I was facing this issue with Java 8 but it got solved after upgrading to Java 11
Here normally this kind of exception occurs when there is mismatch in the PATH of trusted certificate. Check the configuration or path where this server certificate is required for secured communication.
I have a class that will download a file from a https server. When I run it, it returns a lot of errors. It seems that I have a problem with my certificate. Is it possible to ignore the client-server authentication? If so, how?
package com.da;
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.CharBuffer;
import java.util.concurrent.Future;
import org.apache.http.HttpResponse;
import org.apache.http.client.utils.URIUtils;
import org.apache.http.impl.nio.client.DefaultHttpAsyncClient;
import org.apache.http.nio.IOControl;
import org.apache.http.nio.client.HttpAsyncClient;
import org.apache.http.nio.client.methods.AsyncCharConsumer;
import org.apache.http.nio.client.methods.HttpAsyncGet;
import org.apache.http.nio.client.methods.HttpAsyncPost;
public class RSDDownloadFile {
static FileOutputStream fos;
public void DownloadFile(String URI, String Request) throws Exception
{
java.net.URI uri = URIUtils.createURI("https", "176.66.3.69:6443", -1, "download.aspx",
"Lang=EN&AuthToken=package", null);
System.out.println("URI Query: " + uri.toString());
HttpAsyncClient httpclient = new DefaultHttpAsyncClient();
httpclient.start();
try {
Future<Boolean> future = httpclient.execute(
new HttpAsyncGet(uri),
new ResponseCallback(), null);
Boolean result = future.get();
if (result != null && result.booleanValue()) {
System.out.println("\nRequest successfully executed");
} else {
System.out.println("Request failed");
}
}
catch(Exception e){
System.out.println("[DownloadFile] Exception: " + e.getMessage());
}
finally {
System.out.println("Shutting down");
httpclient.shutdown();
}
System.out.println("Done");
}
static class ResponseCallback extends AsyncCharConsumer<Boolean> {
#Override
protected void onResponseReceived(final HttpResponse response) {
System.out.println("Response: " + response.getStatusLine());
System.out.println("Header: " + response.toString());
try {
//if(response.getStatusLine().getStatusCode()==200)
fos = new FileOutputStream( "Response.html" );
}catch(Exception e){
System.out.println("[onResponseReceived] Exception: " + e.getMessage());
}
}
#Override
protected void onCharReceived(final CharBuffer buf, final IOControl ioctrl) throws IOException {
try
{
while (buf.hasRemaining())
{
//System.out.print(buf.get());
fos.write(buf.get());
}
}catch(Exception e)
{
System.out.println("[onCharReceived] Exception: " + e.getMessage());
}
}
#Override
protected void onCleanup() {
try
{
if(fos!=null)
fos.close();
}catch(Exception e){
System.out.println("[onCleanup] Exception: " + e.getMessage());
}
System.out.println("onCleanup()");
}
#Override
protected Boolean buildResult() {
return Boolean.TRUE;
}
}
}
Errors:
URI Query: https://176.66.3.69:6443/download.aspx?Lang=EN&AuthToken=package
Aug 2, 2011 3:47:57 PM org.apache.http.impl.nio.client.NHttpClientProtocolHandler exception
SEVERE: I/O error: General SSLEngine problem
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at com.sun.net.ssl.internal.ssl.Handshaker.checkThrown(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.wrap(Unknown Source)
at javax.net.ssl.SSLEngine.wrap(Unknown Source)
at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:154)
at org.apache.http.impl.nio.reactor.SSLIOSession.isAppInputReady(SSLIOSession.java:276)
at org.apache.http.impl.nio.client.InternalClientEventDispatch.inputReady(InternalClientEventDispatch.java:79)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:161)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:335)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:275)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:542)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Unknown Source)
at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:180)
... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(Unknown Source)
... 16 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 21 more
onCleanup()
[DownloadFile] Exception: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
Shutting down
Done
The problem appears when your server has self signed certificate. To workaround it you can add this certificate to the list of trusted certificates of your JVM.
In this article author describes how to fetch the certificate from your browser and add it to cacerts file of your JVM. You can either edit JAVA_HOME/jre/lib/security/cacerts file or run you application with -Djavax.net.ssl.trustStore parameter. Verify which JDK/JRE you are using too as this is often a source of confusion.
See also: How are SSL certificate server names resolved/Can I add alternative names using keytool? If you run into java.security.cert.CertificateException: No name matching localhost found exception.
Here's what reliably works for me on macOS. Make sure to replace example.com and 443 with the actual hostname and port you're trying to connect to, and give a custom alias. The first command downloads the provided certificate from the remote server and saves it locally in x509 format. The second command loads the saved certificate into Java's SSL trust store.
openssl x509 -in <(openssl s_client -connect example.com:443 -prexit 2>/dev/null) -out ~/example.crt
sudo keytool -importcert -file ~/example.crt -alias example -keystore $(/usr/libexec/java_home)/jre/lib/security/cacerts -storepass changeit
I had the same issue with a valid signed wildcard certificate from symantec.
First try running your java application with -Djavax.net.debug=SSL to see what is really going on.
I ended up importing the intermediate certificate which was causing the cert chain to break.
I downloaded the missing intermediate cert from symantec (you can see the download link to the missing cert in the ssl handshake log: http://svrintl-g3-aia.verisign.com/SVRIntlG3.cer in my case).
And I imported the cert in the java keystore. After importing the intermediate certificate my wildcard ssl cert finally started working:
keytool -import -keystore ../jre/lib/security/cacerts -trustcacerts -alias "VeriSign Class 3 International Server CA - G3" -file /pathto/SVRIntlG3.cer
Export the SSL certificate using Firefox. You can export it by hitting the URL in the browser and then select the option to export the certificate. Let's assume the cert file name is your.ssl.server.name.crt
Go to your JRE_HOME/bin or JDK/JRE/bin
Type the command
keytool -keystore ..\lib\security\cacerts -import -alias your.ssl.server.name -file .\relative-path-to-cert-file\your.ssl.server.name.crt
Restart your Java process
#Gabe Martin-Dempesy's answer is helped to me. And I wrote a small script related to it. The usage is very simple.
Install a certificate from host:
> sudo ./java-cert-importer.sh example.com
Remove the certificate that installed already.
> sudo ./java-cert-importer.sh example.com --delete
java-cert-importer.sh
#!/usr/bin/env bash
# Exit on error
set -e
# Ensure script is running as root
if [ "$EUID" -ne 0 ]
then echo "WARN: Please run as root (sudo)"
exit 1
fi
# Check required commands
command -v openssl >/dev/null 2>&1 || { echo "Required command 'openssl' not installed. Aborting." >&2; exit 1; }
command -v keytool >/dev/null 2>&1 || { echo "Required command 'keytool' not installed. Aborting." >&2; exit 1; }
# Get command line args
host=$1; port=${2:-443}; deleteCmd=${3:-${2}}
# Check host argument
if [ ! ${host} ]; then
cat << EOF
Please enter required parameter(s)
usage: ./java-cert-importer.sh <host> [ <port> | default=443 ] [ -d | --delete ]
EOF
exit 1
fi;
if [ "$JAVA_HOME" ]; then
javahome=${JAVA_HOME}
elif [[ "$OSTYPE" == "linux-gnu" ]]; then # Linux
javahome=$(readlink -f $(which java) | sed "s:bin/java::")
elif [[ "$OSTYPE" == "darwin"* ]]; then # Mac OS X
javahome="$(/usr/libexec/java_home)/jre"
fi
if [ ! "$javahome" ]; then
echo "WARN: Java home cannot be found."
exit 1
elif [ ! -d "$javahome" ]; then
echo "WARN: Detected Java home does not exists: $javahome"
exit 1
fi
echo "Detected Java Home: $javahome"
# Set cacerts file path
cacertspath=${javahome}/lib/security/cacerts
cacertsbackup="${cacertspath}.$$.backup"
if ( [ "$deleteCmd" == "-d" ] || [ "$deleteCmd" == "--delete" ] ); then
sudo keytool -delete -alias ${host} -keystore ${cacertspath} -storepass changeit
echo "Certificate is deleted for ${host}"
exit 0
fi
# Get host info from user
#read -p "Enter server host (E.g. example.com) : " host
#read -p "Enter server port (Default 443) : " port
# create temp file
tmpfile="/tmp/${host}.$$.crt"
# Create java cacerts backup file
cp ${cacertspath} ${cacertsbackup}
echo "Java CaCerts Backup: ${cacertsbackup}"
# Get certificate from speficied host
openssl x509 -in <(openssl s_client -connect ${host}:${port} -prexit 2>/dev/null) -out ${tmpfile}
# Import certificate into java cacerts file
sudo keytool -importcert -file ${tmpfile} -alias ${host} -keystore ${cacertspath} -storepass changeit
# Remove temp certificate file
rm ${tmpfile}
# Check certificate alias name (same with host) that imported successfully
result=$(keytool -list -v -keystore ${cacertspath} -storepass changeit | grep "Alias name: ${host}")
# Show results to user
if [ "$result" ]; then
echo "Success: Certificate is imported to java cacerts for ${host}";
else
echo "Error: Something went wrong";
fi;
Quoting from No more 'unable to find valid certification path to requested target'
when trying to open an SSL connection to a host using JSSE. What this usually means is that the server is using a test certificate (possibly generated using keytool) rather than a certificate from a well known commercial Certification Authority such as Verisign or GoDaddy. Web browsers display warning dialogs in this case, but since JSSE cannot assume an interactive user is present it just throws an exception by default.
Certificate validation is a very important part of SSL security, but I am not writing this entry to explain the details. If you are interested, you can start by reading the Wikipedia blurb. I am writing this entry to show a simple way to talk to that host with the test certificate, if you really want to.
Basically, you want to add the server's certificate to the KeyStore with your trusted certificates
Try the code provided there. It might help.
This solved my issue,
We need to import the cert onto the local java. If not we could get the below exception.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
SSLPOKE is a tool where you can test the https connectivity from your local machine.
Command to test the connectivity:
"%JAVA_HOME%/bin/java" SSLPoke <hostname> 443
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
at sun.security.validator.Validator.validate(Validator.java:260)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138)
at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to
requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
... 15 more
keytool -import -alias <anyname> -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -file <cert path>
this would first prompt to "Enter keystore password:" changeit is the default password. and finally a prompt "Trust this certificate? [no]:", provide "yes" to add the cert to keystore.
Verfication:
C:\tools>"%JAVA_HOME%/bin/java" SSLPoke <hostname> 443
Successfully connected
Simple Steps that I followed.
problem: I was trying to connect to an endpoint(https://%s.blob.core.windows.net) using a simple java class(main method).
So I was getting this certification issue as mentioned above, in the question.
Solution:
Get the certificate using a browser(chrome). To do this paste your endpoint URL in the browser and enter. Now you will see a lock icon, click on that -->certificate--> details --> copy to files--> download it.
open the cmd(i am using windows) as admin and then navigate to the directory where you have downloaded the .cer file.
3.(Optional)If you are using multiple JDK in the same machine then change your JDK version the same as you are using in your application.
Now use the below command
keytool -import -alias mycertificate -keystore "C:\Program
Files\Java\jdk-11.0.5\lib\security\cacerts" -file myurlcrt.cer
Give the default password: changeit
Trust this certificate: yes
And you are done.
Thanks!
I was able to get it working with code only, i.e. no need to use keytool:
import com.netflix.config.DynamicBooleanProperty;
import com.netflix.config.DynamicIntProperty;
import com.netflix.config.DynamicPropertyFactory;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.ssl.SSLContexts;
import org.apache.http.conn.ssl.TrustStrategy;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.nio.client.CloseableHttpAsyncClient;
import org.apache.http.impl.nio.client.HttpAsyncClients;
import org.apache.http.impl.nio.conn.PoolingNHttpClientConnectionManager;
import org.apache.http.impl.nio.reactor.DefaultConnectingIOReactor;
import org.apache.http.impl.nio.reactor.IOReactorConfig;
import org.apache.http.nio.conn.NoopIOSessionStrategy;
import org.apache.http.nio.conn.SchemeIOSessionStrategy;
import org.apache.http.nio.conn.ssl.SSLIOSessionStrategy;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
import java.io.IOException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public class Test
{
private static final DynamicIntProperty MAX_TOTAL_CONNECTIONS = DynamicPropertyFactory.getInstance().getIntProperty("X.total.connections", 40);
private static final DynamicIntProperty ROUTE_CONNECTIONS = DynamicPropertyFactory.getInstance().getIntProperty("X.total.connections", 40);
private static final DynamicIntProperty CONNECT_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.connect.timeout", 60000);
private static final DynamicIntProperty SOCKET_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.socket.timeout", -1);
private static final DynamicIntProperty CONNECTION_REQUEST_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.connectionrequest.timeout", 60000);
private static final DynamicBooleanProperty STALE_CONNECTION_CHECK = DynamicPropertyFactory.getInstance().getBooleanProperty("X.checkconnection", true);
public static void main(String[] args) throws Exception
{
SSLContext sslcontext = SSLContexts.custom()
.useTLS()
.loadTrustMaterial(null, new TrustStrategy()
{
#Override
public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException
{
return true;
}
})
.build();
SSLIOSessionStrategy sslSessionStrategy = new SSLIOSessionStrategy(sslcontext, new AllowAll());
Registry<SchemeIOSessionStrategy> sessionStrategyRegistry = RegistryBuilder.<SchemeIOSessionStrategy>create()
.register("http", NoopIOSessionStrategy.INSTANCE)
.register("https", sslSessionStrategy)
.build();
DefaultConnectingIOReactor ioReactor = new DefaultConnectingIOReactor(IOReactorConfig.DEFAULT);
PoolingNHttpClientConnectionManager connectionManager = new PoolingNHttpClientConnectionManager(ioReactor, sessionStrategyRegistry);
connectionManager.setMaxTotal(MAX_TOTAL_CONNECTIONS.get());
connectionManager.setDefaultMaxPerRoute(ROUTE_CONNECTIONS.get());
RequestConfig requestConfig = RequestConfig.custom()
.setSocketTimeout(SOCKET_TIMEOUT.get())
.setConnectTimeout(CONNECT_TIMEOUT.get())
.setConnectionRequestTimeout(CONNECTION_REQUEST_TIMEOUT.get())
.setStaleConnectionCheckEnabled(STALE_CONNECTION_CHECK.get())
.build();
CloseableHttpAsyncClient httpClient = HttpAsyncClients.custom()
.setSSLStrategy(sslSessionStrategy)
.setConnectionManager(connectionManager)
.setDefaultRequestConfig(requestConfig)
.build();
httpClient.start();
// use httpClient...
}
private static class AllowAll implements X509HostnameVerifier
{
#Override
public void verify(String s, SSLSocket sslSocket) throws IOException
{}
#Override
public void verify(String s, X509Certificate x509Certificate) throws SSLException {}
#Override
public void verify(String s, String[] strings, String[] strings2) throws SSLException
{}
#Override
public boolean verify(String s, SSLSession sslSession)
{
return true;
}
}
}
The source of this error on my Apache 2.4 instance (using a Comodo wildcard certificate) was an incomplete path to the SHA-1 signed root certificate. There were multiple chains in the issued certificate, and the chain leading to a SHA-1 root certificate was missing an intermediate certificate. Modern browsers know how to handle this, but Java 7 doesn't handle it by default (although there are some convoluted ways to accomplish this in code). The result is error messages that look identical to the case of self-signed certificates:
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
... 22 more
In this case, the "unable to find valid certification path to requested target" message is being produced due to the missing intermediate certificate. You can check which certificate is missing using SSL Labs test against the server. Once you find the appropriate certificate, download it and (if the server is under your control) add it to the certificate bundle. Alternatively, you can import the missing certificate locally. Accommodating this issue on the server is a more general solution to the problem.
For Windows only, follow these steps:
In Chrome go to settings.
In Settings click show advance settings.
Under HTTPS/SSL Click on Manage Certificates.
Export Your Certificate.
In Windows searchs (Pressing windows key on keyboard) type java.
Select (Configure Java) Option Which will open Java Control Panel
Select Security tab in Java Control Panel
Select Manage Certificates
Click Import
Under (User) tab selected and certificate type as (Trusted Certificates)
Click import button and browse to downloaded certificate and import it.
There is a lot of way to solve this...
One way is set the TrustStore certificates in a keystore file and put it in the path of the application, and set these system properties in the main method:
public static void main(String[] args) {
System.setProperty("javax.net.ssl.trustStore", "trust-store.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "TrustStore");
...
}
Other way is place the keystore as resource file inside the project jar file and load it:
public static SSLContext createSSLContext(String resourcePath, String pass) throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException, UnrecoverableKeyException, KeyManagementException {
// initialise the keystore
final char[] password = pass.toCharArray();
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(ThisClass.class.getResourceAsStream(resourcePath
), password);
// Setup the key manager factory.
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(ks, password);
// Setup the trust manager factory.
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
tmf.init(ks);
SSLContext sslc = SSLContext.getInstance("TLS");
sslc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
return sslc;
}
public static void main(String[] args) {
SSLContext.setDefault(
createSSLContext("/trust-store.jks", "TrustStore"));
...
}
In windows you can try this solution too: https://stackoverflow.com/a/59056537/980442
I created the keystore file from a Certificate authority CA .crt file in this way:
keytool -import -alias ca -keystore trust-store.jks -storepass TrustStore -trustcacerts -file ca.crt
FYI: https://docs.oracle.com/javadb/10.8.3.0/adminguide/cadminsslclient.html
For those who like Debian and prepackaged Java:
sudo mkdir /usr/share/ca-certificates/test/ # don't mess with other certs
sudo cp ~/tmp/test.loc.crt /usr/share/ca-certificates/test/
sudo dpkg-reconfigure --force ca-certificates # check your cert in curses GUI!
sudo update-ca-certificates --fresh --verbose
Don't forget to check /etc/default/cacerts for:
# enable/disable updates of the keystore /etc/ssl/certs/java/cacerts
cacerts_updates=yes
To remove cert:
sudo rm /usr/share/ca-certificates/test/test.loc.crt
sudo rm /etc/ssl/certs/java/cacerts
sudo update-ca-certificates --fresh --verbose
UPDATE: That a reboot helped was coincidental (I hoped so, hooray!). The real cause of the problem was this: When Gradle is directed to use a specific keystore, that keystore must also contain all the official root certificates. Otherwise it cannot access libraries from regular repositories. What I had to do was this:
Import the self-signed certificate:
keytool -import -trustcacerts -alias myselfsignedcert -file /Users/me/Desktop/selfsignedcert.crt -keystore ./privateKeystore.jks
Add the official root certificates:
keytool -importkeystore -srckeystore <java-home>/lib/security/cacerts -destkeystore ./privateKeystore.jks
Maybe the Gradle daemon also got in the way. Might be worth killing all running daemons found with ./gradlew --status if things start looking bleak.
ORIGINAL POSTING:
Nobody will believe this, I know. Still, if all else fails, give it a try:
After a reboot of my Mac the problem was gone. Grrr.
Background:
./gradlew jar kept giving me "unable to find valid certification path to requested target"
I am stuck with a self-signed certificate, saved from browser, imported in privateKeystore.jks. Then instructed Gradle to work with privateKeystore.jks:
org.gradle.jvmargs=-Djavax.net.debug=SSL -Djavax.net.ssl.trustStore="/Users/me/IntelliJ/myproject/privateKeystore.jks" -Djavax.net.ssl.trustStorePassword=changeit
As mentioned, this only worked after a reboot.
Had the issue like this image.
Tried a few solutions.
But found that even if it's same project, when it's on other one's working place, it's totally fine. No extra settings needed. So we guessed it's an enviroment issue. We tried changing JDK version, IDE but didn't work. it took about 4 hours for investigation, until we tried the top-rated answer. I didn't find the error mentioned in that answer but I found via my browser about HTTP URL (lock) that there was a certification of Charles. Then I realized my charles was on all the time. As long as I turned that off, it's working all fine.
So I left my experience that could be helpful for your case.
This can also be caused by using GoDaddy certs with Java 7 that are signed using SHA2.
Chrome and all other browsers are starting to deprecate SSL certs that are signed using SHA1, as it's not as secure.
More info on the issue can be found here, as well as how to resolve it on your server if you need to now.
AVG version 18.1.3044 (with Windows 10) interfer with my local Spring application.
Solution: enter in AVG section called "Web and email" and disable the "email protection".
AVG block the certificate if the site isn't secure.
I had the same problem with the certificates error and it was because of SNI: the http client that I used didn't have SNI implemented. So a version update did the job
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.3.6</version>
</dependency>
Download the certificate from Nexus3 Browser (click on the lock-pad for View Site Information in case of Edge broser)
Click on Connection is secure
Click on the certificate details
Click on Copy To file (it opens up export certificate wizard)
Choose Base-64 encoding
Browse and select a download location and file-name (let’s say mycert)
Open cmd
Goto the download location and execute the below command
keytool -import -alias mycert -keystore "<<your-JAVA_HOME-directory>>\jre\lib\security\cacerts" -file mycert.cer
Restart the machine
Execute maven build again.
And if you are here in 2022 and are on mac follow this
1. Download the certificate.
echo -n | openssl s_client -connect <ServerName>:<PORT> -servername <ServerName> \
| openssl x509 > /tmp/<ServerName>.cert
2. Find your JDK path by executing the command.
/usr/libexec/java_home
3. Now import the cert into the cert-store of jdk.
sudo keytool -import -alias mycertificate -keystore "<JDK_HOME>/lib/security/cacerts" -file /tmp/<ServerName>.cert
You have two options, import the self-signed cert into java's keystore for each jvm the software will run on or try the non-validating ssl factory:
jdbc:postgresql://myserver.com:5432/mydatabasename?ssl=true&sslfactory=org.postgresql.ssl.NonValidatingFactory
Make sure that the https://176.66.3.69:6443/ have a valid certificate.
you can check it via browser firstly if it works in browser it will work in java.
that is working for me
If getting this error in maven, or maven with TestNG :
download the certificate from the target website and install certificate on your machine (using keytool as suggested above, or on windows)
add the following content to the maven arguments (command line and/or IDE):
-Djavax.net.ssl.trustStore=C:\Users\me.keystore -Djavax.net.ssl.trustStorePassword=X
Where X is the password you used at the keytool step.
note : C:\Users\me.keystore should also be set to match your machine.
For instance :
mvn -ea -Dtestng.dtd.http=true -Djavax.net.ssl.trustStore=C:\Users\me\.keystore -Djavax.net.ssl.trustStorePassword=X -Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true -Dmaven.wagon.http.ssl.ignore.validity.dates=true -Dcucumber.features=src/test/resources -Dcucumber.glue=com.myapp -Dcucumber.filter.tags="#MY_TEST"
In my case I'm running MacOs High Sierra with Java 1.6. The cacert file is in a different location than referenced above in Gabe Martin-Dempesy's answer. The cacert file was also already linked to another location (/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/cacerts).
Using FireFox, I exported the certificate from the web site in question to a local file called "exportedCertFile.crt". From there, I used keytool to move the certificate into the cacert file. This fixed the problem.
bash-3.2# cd /Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib/security/
bash-3.2# keytool -importcert -file ~/exportedCertFile.crt -alias example -keystore cacerts -storepass changeit
first Download the ssl certificate then you can go to your java bin path execute the below command in the console.
C:\java\JDK1.8.0_66-X64\bin>keytool -printcert -file C:\Users\lova\openapi.cer -keystore openapistore
In my case I had both keystore and truststore having the same certificate so removing truststore helped. Sometimes the chain of certificates can be an issue if you've multiple copies of certificates.
As original question was - how to ignore the cert error, here is solution for those using SpringBoot and RestTemplate
#Service
public class SomeService {
private final RestTemplate restTemplate;
private final ObjectMapper objectMapper;
private static HttpComponentsClientHttpRequestFactory createRequestFactory() {
try {
SSLContextBuilder sslContext = new SSLContextBuilder();
sslContext.loadTrustMaterial(null, new TrustAllStrategy());
CloseableHttpClient client = HttpClients.custom().setSSLContext(sslContext.build()).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(client);
return requestFactory;
} catch (KeyManagementException | KeyStoreException | NoSuchAlgorithmException var3) {
throw new IllegalStateException("Couldn't create HTTP Request factory ignore SSL cert validity: ", var3);
}
}
#Autowired
public SomeService(RestTemplate restTemplate, ObjectMapper objectMapper) {
this.objectMapper = objectMapper;
this.dimetorURL = dimetorURL;
restTemplate.setRequestFactory(createRequestFactory());
}
public ResponseEntity<ResponseObject> sendRequest(RequestObject requestObject) {
//...
return restTemplate.exchange(url, HttpMethod.GET, ResponseObject.class);
//...
}
}
This is what worked for me on macOS. Replace server-name and server-port with your own.
Run these two commands on your terminal.
Download certificate from the remote server
openssl x509 -in <(openssl s_client -connect server-name:server-port -prexit 2>/dev/null) -out ~/server-name.crt
Import cert to Java keystore
sudo keytool -importcert -file ~/server-name.crt -alias server-name -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
Restart your application and the certs errors should go away!
This works on any OS you just need JDK installed :
Download the certificate from the remote server :
keytool -printcert -rfc -sslserver <your remote server hostname> > /tmp/remorte-cert.crt
Import the certificate to your JDK keystore :
keytool -importcert -file /tmp/remorte-cert.crt -alias <an alias for your remote server> -storepass changeit -keystore "${JAVA_HOME}/lib/security/cacerts" -noprompt
I have a class that will download a file from a https server. When I run it, it returns a lot of errors. It seems that I have a problem with my certificate. Is it possible to ignore the client-server authentication? If so, how?
package com.da;
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.CharBuffer;
import java.util.concurrent.Future;
import org.apache.http.HttpResponse;
import org.apache.http.client.utils.URIUtils;
import org.apache.http.impl.nio.client.DefaultHttpAsyncClient;
import org.apache.http.nio.IOControl;
import org.apache.http.nio.client.HttpAsyncClient;
import org.apache.http.nio.client.methods.AsyncCharConsumer;
import org.apache.http.nio.client.methods.HttpAsyncGet;
import org.apache.http.nio.client.methods.HttpAsyncPost;
public class RSDDownloadFile {
static FileOutputStream fos;
public void DownloadFile(String URI, String Request) throws Exception
{
java.net.URI uri = URIUtils.createURI("https", "176.66.3.69:6443", -1, "download.aspx",
"Lang=EN&AuthToken=package", null);
System.out.println("URI Query: " + uri.toString());
HttpAsyncClient httpclient = new DefaultHttpAsyncClient();
httpclient.start();
try {
Future<Boolean> future = httpclient.execute(
new HttpAsyncGet(uri),
new ResponseCallback(), null);
Boolean result = future.get();
if (result != null && result.booleanValue()) {
System.out.println("\nRequest successfully executed");
} else {
System.out.println("Request failed");
}
}
catch(Exception e){
System.out.println("[DownloadFile] Exception: " + e.getMessage());
}
finally {
System.out.println("Shutting down");
httpclient.shutdown();
}
System.out.println("Done");
}
static class ResponseCallback extends AsyncCharConsumer<Boolean> {
#Override
protected void onResponseReceived(final HttpResponse response) {
System.out.println("Response: " + response.getStatusLine());
System.out.println("Header: " + response.toString());
try {
//if(response.getStatusLine().getStatusCode()==200)
fos = new FileOutputStream( "Response.html" );
}catch(Exception e){
System.out.println("[onResponseReceived] Exception: " + e.getMessage());
}
}
#Override
protected void onCharReceived(final CharBuffer buf, final IOControl ioctrl) throws IOException {
try
{
while (buf.hasRemaining())
{
//System.out.print(buf.get());
fos.write(buf.get());
}
}catch(Exception e)
{
System.out.println("[onCharReceived] Exception: " + e.getMessage());
}
}
#Override
protected void onCleanup() {
try
{
if(fos!=null)
fos.close();
}catch(Exception e){
System.out.println("[onCleanup] Exception: " + e.getMessage());
}
System.out.println("onCleanup()");
}
#Override
protected Boolean buildResult() {
return Boolean.TRUE;
}
}
}
Errors:
URI Query: https://176.66.3.69:6443/download.aspx?Lang=EN&AuthToken=package
Aug 2, 2011 3:47:57 PM org.apache.http.impl.nio.client.NHttpClientProtocolHandler exception
SEVERE: I/O error: General SSLEngine problem
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at com.sun.net.ssl.internal.ssl.Handshaker.checkThrown(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.wrap(Unknown Source)
at javax.net.ssl.SSLEngine.wrap(Unknown Source)
at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:154)
at org.apache.http.impl.nio.reactor.SSLIOSession.isAppInputReady(SSLIOSession.java:276)
at org.apache.http.impl.nio.client.InternalClientEventDispatch.inputReady(InternalClientEventDispatch.java:79)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:161)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:335)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:275)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:542)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Unknown Source)
at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:180)
... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(Unknown Source)
... 16 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 21 more
onCleanup()
[DownloadFile] Exception: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
Shutting down
Done
The problem appears when your server has self signed certificate. To workaround it you can add this certificate to the list of trusted certificates of your JVM.
In this article author describes how to fetch the certificate from your browser and add it to cacerts file of your JVM. You can either edit JAVA_HOME/jre/lib/security/cacerts file or run you application with -Djavax.net.ssl.trustStore parameter. Verify which JDK/JRE you are using too as this is often a source of confusion.
See also: How are SSL certificate server names resolved/Can I add alternative names using keytool? If you run into java.security.cert.CertificateException: No name matching localhost found exception.
Here's what reliably works for me on macOS. Make sure to replace example.com and 443 with the actual hostname and port you're trying to connect to, and give a custom alias. The first command downloads the provided certificate from the remote server and saves it locally in x509 format. The second command loads the saved certificate into Java's SSL trust store.
openssl x509 -in <(openssl s_client -connect example.com:443 -prexit 2>/dev/null) -out ~/example.crt
sudo keytool -importcert -file ~/example.crt -alias example -keystore $(/usr/libexec/java_home)/jre/lib/security/cacerts -storepass changeit
I had the same issue with a valid signed wildcard certificate from symantec.
First try running your java application with -Djavax.net.debug=SSL to see what is really going on.
I ended up importing the intermediate certificate which was causing the cert chain to break.
I downloaded the missing intermediate cert from symantec (you can see the download link to the missing cert in the ssl handshake log: http://svrintl-g3-aia.verisign.com/SVRIntlG3.cer in my case).
And I imported the cert in the java keystore. After importing the intermediate certificate my wildcard ssl cert finally started working:
keytool -import -keystore ../jre/lib/security/cacerts -trustcacerts -alias "VeriSign Class 3 International Server CA - G3" -file /pathto/SVRIntlG3.cer
Export the SSL certificate using Firefox. You can export it by hitting the URL in the browser and then select the option to export the certificate. Let's assume the cert file name is your.ssl.server.name.crt
Go to your JRE_HOME/bin or JDK/JRE/bin
Type the command
keytool -keystore ..\lib\security\cacerts -import -alias your.ssl.server.name -file .\relative-path-to-cert-file\your.ssl.server.name.crt
Restart your Java process
#Gabe Martin-Dempesy's answer is helped to me. And I wrote a small script related to it. The usage is very simple.
Install a certificate from host:
> sudo ./java-cert-importer.sh example.com
Remove the certificate that installed already.
> sudo ./java-cert-importer.sh example.com --delete
java-cert-importer.sh
#!/usr/bin/env bash
# Exit on error
set -e
# Ensure script is running as root
if [ "$EUID" -ne 0 ]
then echo "WARN: Please run as root (sudo)"
exit 1
fi
# Check required commands
command -v openssl >/dev/null 2>&1 || { echo "Required command 'openssl' not installed. Aborting." >&2; exit 1; }
command -v keytool >/dev/null 2>&1 || { echo "Required command 'keytool' not installed. Aborting." >&2; exit 1; }
# Get command line args
host=$1; port=${2:-443}; deleteCmd=${3:-${2}}
# Check host argument
if [ ! ${host} ]; then
cat << EOF
Please enter required parameter(s)
usage: ./java-cert-importer.sh <host> [ <port> | default=443 ] [ -d | --delete ]
EOF
exit 1
fi;
if [ "$JAVA_HOME" ]; then
javahome=${JAVA_HOME}
elif [[ "$OSTYPE" == "linux-gnu" ]]; then # Linux
javahome=$(readlink -f $(which java) | sed "s:bin/java::")
elif [[ "$OSTYPE" == "darwin"* ]]; then # Mac OS X
javahome="$(/usr/libexec/java_home)/jre"
fi
if [ ! "$javahome" ]; then
echo "WARN: Java home cannot be found."
exit 1
elif [ ! -d "$javahome" ]; then
echo "WARN: Detected Java home does not exists: $javahome"
exit 1
fi
echo "Detected Java Home: $javahome"
# Set cacerts file path
cacertspath=${javahome}/lib/security/cacerts
cacertsbackup="${cacertspath}.$$.backup"
if ( [ "$deleteCmd" == "-d" ] || [ "$deleteCmd" == "--delete" ] ); then
sudo keytool -delete -alias ${host} -keystore ${cacertspath} -storepass changeit
echo "Certificate is deleted for ${host}"
exit 0
fi
# Get host info from user
#read -p "Enter server host (E.g. example.com) : " host
#read -p "Enter server port (Default 443) : " port
# create temp file
tmpfile="/tmp/${host}.$$.crt"
# Create java cacerts backup file
cp ${cacertspath} ${cacertsbackup}
echo "Java CaCerts Backup: ${cacertsbackup}"
# Get certificate from speficied host
openssl x509 -in <(openssl s_client -connect ${host}:${port} -prexit 2>/dev/null) -out ${tmpfile}
# Import certificate into java cacerts file
sudo keytool -importcert -file ${tmpfile} -alias ${host} -keystore ${cacertspath} -storepass changeit
# Remove temp certificate file
rm ${tmpfile}
# Check certificate alias name (same with host) that imported successfully
result=$(keytool -list -v -keystore ${cacertspath} -storepass changeit | grep "Alias name: ${host}")
# Show results to user
if [ "$result" ]; then
echo "Success: Certificate is imported to java cacerts for ${host}";
else
echo "Error: Something went wrong";
fi;
Quoting from No more 'unable to find valid certification path to requested target'
when trying to open an SSL connection to a host using JSSE. What this usually means is that the server is using a test certificate (possibly generated using keytool) rather than a certificate from a well known commercial Certification Authority such as Verisign or GoDaddy. Web browsers display warning dialogs in this case, but since JSSE cannot assume an interactive user is present it just throws an exception by default.
Certificate validation is a very important part of SSL security, but I am not writing this entry to explain the details. If you are interested, you can start by reading the Wikipedia blurb. I am writing this entry to show a simple way to talk to that host with the test certificate, if you really want to.
Basically, you want to add the server's certificate to the KeyStore with your trusted certificates
Try the code provided there. It might help.
This solved my issue,
We need to import the cert onto the local java. If not we could get the below exception.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
SSLPOKE is a tool where you can test the https connectivity from your local machine.
Command to test the connectivity:
"%JAVA_HOME%/bin/java" SSLPoke <hostname> 443
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
at sun.security.validator.Validator.validate(Validator.java:260)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138)
at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to
requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
... 15 more
keytool -import -alias <anyname> -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -file <cert path>
this would first prompt to "Enter keystore password:" changeit is the default password. and finally a prompt "Trust this certificate? [no]:", provide "yes" to add the cert to keystore.
Verfication:
C:\tools>"%JAVA_HOME%/bin/java" SSLPoke <hostname> 443
Successfully connected
Simple Steps that I followed.
problem: I was trying to connect to an endpoint(https://%s.blob.core.windows.net) using a simple java class(main method).
So I was getting this certification issue as mentioned above, in the question.
Solution:
Get the certificate using a browser(chrome). To do this paste your endpoint URL in the browser and enter. Now you will see a lock icon, click on that -->certificate--> details --> copy to files--> download it.
open the cmd(i am using windows) as admin and then navigate to the directory where you have downloaded the .cer file.
3.(Optional)If you are using multiple JDK in the same machine then change your JDK version the same as you are using in your application.
Now use the below command
keytool -import -alias mycertificate -keystore "C:\Program
Files\Java\jdk-11.0.5\lib\security\cacerts" -file myurlcrt.cer
Give the default password: changeit
Trust this certificate: yes
And you are done.
Thanks!
I was able to get it working with code only, i.e. no need to use keytool:
import com.netflix.config.DynamicBooleanProperty;
import com.netflix.config.DynamicIntProperty;
import com.netflix.config.DynamicPropertyFactory;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.ssl.SSLContexts;
import org.apache.http.conn.ssl.TrustStrategy;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.nio.client.CloseableHttpAsyncClient;
import org.apache.http.impl.nio.client.HttpAsyncClients;
import org.apache.http.impl.nio.conn.PoolingNHttpClientConnectionManager;
import org.apache.http.impl.nio.reactor.DefaultConnectingIOReactor;
import org.apache.http.impl.nio.reactor.IOReactorConfig;
import org.apache.http.nio.conn.NoopIOSessionStrategy;
import org.apache.http.nio.conn.SchemeIOSessionStrategy;
import org.apache.http.nio.conn.ssl.SSLIOSessionStrategy;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
import java.io.IOException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public class Test
{
private static final DynamicIntProperty MAX_TOTAL_CONNECTIONS = DynamicPropertyFactory.getInstance().getIntProperty("X.total.connections", 40);
private static final DynamicIntProperty ROUTE_CONNECTIONS = DynamicPropertyFactory.getInstance().getIntProperty("X.total.connections", 40);
private static final DynamicIntProperty CONNECT_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.connect.timeout", 60000);
private static final DynamicIntProperty SOCKET_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.socket.timeout", -1);
private static final DynamicIntProperty CONNECTION_REQUEST_TIMEOUT = DynamicPropertyFactory.getInstance().getIntProperty("X.connectionrequest.timeout", 60000);
private static final DynamicBooleanProperty STALE_CONNECTION_CHECK = DynamicPropertyFactory.getInstance().getBooleanProperty("X.checkconnection", true);
public static void main(String[] args) throws Exception
{
SSLContext sslcontext = SSLContexts.custom()
.useTLS()
.loadTrustMaterial(null, new TrustStrategy()
{
#Override
public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException
{
return true;
}
})
.build();
SSLIOSessionStrategy sslSessionStrategy = new SSLIOSessionStrategy(sslcontext, new AllowAll());
Registry<SchemeIOSessionStrategy> sessionStrategyRegistry = RegistryBuilder.<SchemeIOSessionStrategy>create()
.register("http", NoopIOSessionStrategy.INSTANCE)
.register("https", sslSessionStrategy)
.build();
DefaultConnectingIOReactor ioReactor = new DefaultConnectingIOReactor(IOReactorConfig.DEFAULT);
PoolingNHttpClientConnectionManager connectionManager = new PoolingNHttpClientConnectionManager(ioReactor, sessionStrategyRegistry);
connectionManager.setMaxTotal(MAX_TOTAL_CONNECTIONS.get());
connectionManager.setDefaultMaxPerRoute(ROUTE_CONNECTIONS.get());
RequestConfig requestConfig = RequestConfig.custom()
.setSocketTimeout(SOCKET_TIMEOUT.get())
.setConnectTimeout(CONNECT_TIMEOUT.get())
.setConnectionRequestTimeout(CONNECTION_REQUEST_TIMEOUT.get())
.setStaleConnectionCheckEnabled(STALE_CONNECTION_CHECK.get())
.build();
CloseableHttpAsyncClient httpClient = HttpAsyncClients.custom()
.setSSLStrategy(sslSessionStrategy)
.setConnectionManager(connectionManager)
.setDefaultRequestConfig(requestConfig)
.build();
httpClient.start();
// use httpClient...
}
private static class AllowAll implements X509HostnameVerifier
{
#Override
public void verify(String s, SSLSocket sslSocket) throws IOException
{}
#Override
public void verify(String s, X509Certificate x509Certificate) throws SSLException {}
#Override
public void verify(String s, String[] strings, String[] strings2) throws SSLException
{}
#Override
public boolean verify(String s, SSLSession sslSession)
{
return true;
}
}
}
The source of this error on my Apache 2.4 instance (using a Comodo wildcard certificate) was an incomplete path to the SHA-1 signed root certificate. There were multiple chains in the issued certificate, and the chain leading to a SHA-1 root certificate was missing an intermediate certificate. Modern browsers know how to handle this, but Java 7 doesn't handle it by default (although there are some convoluted ways to accomplish this in code). The result is error messages that look identical to the case of self-signed certificates:
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
... 22 more
In this case, the "unable to find valid certification path to requested target" message is being produced due to the missing intermediate certificate. You can check which certificate is missing using SSL Labs test against the server. Once you find the appropriate certificate, download it and (if the server is under your control) add it to the certificate bundle. Alternatively, you can import the missing certificate locally. Accommodating this issue on the server is a more general solution to the problem.
For Windows only, follow these steps:
In Chrome go to settings.
In Settings click show advance settings.
Under HTTPS/SSL Click on Manage Certificates.
Export Your Certificate.
In Windows searchs (Pressing windows key on keyboard) type java.
Select (Configure Java) Option Which will open Java Control Panel
Select Security tab in Java Control Panel
Select Manage Certificates
Click Import
Under (User) tab selected and certificate type as (Trusted Certificates)
Click import button and browse to downloaded certificate and import it.
There is a lot of way to solve this...
One way is set the TrustStore certificates in a keystore file and put it in the path of the application, and set these system properties in the main method:
public static void main(String[] args) {
System.setProperty("javax.net.ssl.trustStore", "trust-store.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "TrustStore");
...
}
Other way is place the keystore as resource file inside the project jar file and load it:
public static SSLContext createSSLContext(String resourcePath, String pass) throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException, UnrecoverableKeyException, KeyManagementException {
// initialise the keystore
final char[] password = pass.toCharArray();
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(ThisClass.class.getResourceAsStream(resourcePath
), password);
// Setup the key manager factory.
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(ks, password);
// Setup the trust manager factory.
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
tmf.init(ks);
SSLContext sslc = SSLContext.getInstance("TLS");
sslc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
return sslc;
}
public static void main(String[] args) {
SSLContext.setDefault(
createSSLContext("/trust-store.jks", "TrustStore"));
...
}
In windows you can try this solution too: https://stackoverflow.com/a/59056537/980442
I created the keystore file from a Certificate authority CA .crt file in this way:
keytool -import -alias ca -keystore trust-store.jks -storepass TrustStore -trustcacerts -file ca.crt
FYI: https://docs.oracle.com/javadb/10.8.3.0/adminguide/cadminsslclient.html
For those who like Debian and prepackaged Java:
sudo mkdir /usr/share/ca-certificates/test/ # don't mess with other certs
sudo cp ~/tmp/test.loc.crt /usr/share/ca-certificates/test/
sudo dpkg-reconfigure --force ca-certificates # check your cert in curses GUI!
sudo update-ca-certificates --fresh --verbose
Don't forget to check /etc/default/cacerts for:
# enable/disable updates of the keystore /etc/ssl/certs/java/cacerts
cacerts_updates=yes
To remove cert:
sudo rm /usr/share/ca-certificates/test/test.loc.crt
sudo rm /etc/ssl/certs/java/cacerts
sudo update-ca-certificates --fresh --verbose
UPDATE: That a reboot helped was coincidental (I hoped so, hooray!). The real cause of the problem was this: When Gradle is directed to use a specific keystore, that keystore must also contain all the official root certificates. Otherwise it cannot access libraries from regular repositories. What I had to do was this:
Import the self-signed certificate:
keytool -import -trustcacerts -alias myselfsignedcert -file /Users/me/Desktop/selfsignedcert.crt -keystore ./privateKeystore.jks
Add the official root certificates:
keytool -importkeystore -srckeystore <java-home>/lib/security/cacerts -destkeystore ./privateKeystore.jks
Maybe the Gradle daemon also got in the way. Might be worth killing all running daemons found with ./gradlew --status if things start looking bleak.
ORIGINAL POSTING:
Nobody will believe this, I know. Still, if all else fails, give it a try:
After a reboot of my Mac the problem was gone. Grrr.
Background:
./gradlew jar kept giving me "unable to find valid certification path to requested target"
I am stuck with a self-signed certificate, saved from browser, imported in privateKeystore.jks. Then instructed Gradle to work with privateKeystore.jks:
org.gradle.jvmargs=-Djavax.net.debug=SSL -Djavax.net.ssl.trustStore="/Users/me/IntelliJ/myproject/privateKeystore.jks" -Djavax.net.ssl.trustStorePassword=changeit
As mentioned, this only worked after a reboot.
Had the issue like this image.
Tried a few solutions.
But found that even if it's same project, when it's on other one's working place, it's totally fine. No extra settings needed. So we guessed it's an enviroment issue. We tried changing JDK version, IDE but didn't work. it took about 4 hours for investigation, until we tried the top-rated answer. I didn't find the error mentioned in that answer but I found via my browser about HTTP URL (lock) that there was a certification of Charles. Then I realized my charles was on all the time. As long as I turned that off, it's working all fine.
So I left my experience that could be helpful for your case.
This can also be caused by using GoDaddy certs with Java 7 that are signed using SHA2.
Chrome and all other browsers are starting to deprecate SSL certs that are signed using SHA1, as it's not as secure.
More info on the issue can be found here, as well as how to resolve it on your server if you need to now.
AVG version 18.1.3044 (with Windows 10) interfer with my local Spring application.
Solution: enter in AVG section called "Web and email" and disable the "email protection".
AVG block the certificate if the site isn't secure.
I had the same problem with the certificates error and it was because of SNI: the http client that I used didn't have SNI implemented. So a version update did the job
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.3.6</version>
</dependency>
Download the certificate from Nexus3 Browser (click on the lock-pad for View Site Information in case of Edge broser)
Click on Connection is secure
Click on the certificate details
Click on Copy To file (it opens up export certificate wizard)
Choose Base-64 encoding
Browse and select a download location and file-name (let’s say mycert)
Open cmd
Goto the download location and execute the below command
keytool -import -alias mycert -keystore "<<your-JAVA_HOME-directory>>\jre\lib\security\cacerts" -file mycert.cer
Restart the machine
Execute maven build again.
And if you are here in 2022 and are on mac follow this
1. Download the certificate.
echo -n | openssl s_client -connect <ServerName>:<PORT> -servername <ServerName> \
| openssl x509 > /tmp/<ServerName>.cert
2. Find your JDK path by executing the command.
/usr/libexec/java_home
3. Now import the cert into the cert-store of jdk.
sudo keytool -import -alias mycertificate -keystore "<JDK_HOME>/lib/security/cacerts" -file /tmp/<ServerName>.cert
You have two options, import the self-signed cert into java's keystore for each jvm the software will run on or try the non-validating ssl factory:
jdbc:postgresql://myserver.com:5432/mydatabasename?ssl=true&sslfactory=org.postgresql.ssl.NonValidatingFactory
Make sure that the https://176.66.3.69:6443/ have a valid certificate.
you can check it via browser firstly if it works in browser it will work in java.
that is working for me
If getting this error in maven, or maven with TestNG :
download the certificate from the target website and install certificate on your machine (using keytool as suggested above, or on windows)
add the following content to the maven arguments (command line and/or IDE):
-Djavax.net.ssl.trustStore=C:\Users\me.keystore -Djavax.net.ssl.trustStorePassword=X
Where X is the password you used at the keytool step.
note : C:\Users\me.keystore should also be set to match your machine.
For instance :
mvn -ea -Dtestng.dtd.http=true -Djavax.net.ssl.trustStore=C:\Users\me\.keystore -Djavax.net.ssl.trustStorePassword=X -Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true -Dmaven.wagon.http.ssl.ignore.validity.dates=true -Dcucumber.features=src/test/resources -Dcucumber.glue=com.myapp -Dcucumber.filter.tags="#MY_TEST"
In my case I'm running MacOs High Sierra with Java 1.6. The cacert file is in a different location than referenced above in Gabe Martin-Dempesy's answer. The cacert file was also already linked to another location (/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/cacerts).
Using FireFox, I exported the certificate from the web site in question to a local file called "exportedCertFile.crt". From there, I used keytool to move the certificate into the cacert file. This fixed the problem.
bash-3.2# cd /Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib/security/
bash-3.2# keytool -importcert -file ~/exportedCertFile.crt -alias example -keystore cacerts -storepass changeit
first Download the ssl certificate then you can go to your java bin path execute the below command in the console.
C:\java\JDK1.8.0_66-X64\bin>keytool -printcert -file C:\Users\lova\openapi.cer -keystore openapistore
In my case I had both keystore and truststore having the same certificate so removing truststore helped. Sometimes the chain of certificates can be an issue if you've multiple copies of certificates.
As original question was - how to ignore the cert error, here is solution for those using SpringBoot and RestTemplate
#Service
public class SomeService {
private final RestTemplate restTemplate;
private final ObjectMapper objectMapper;
private static HttpComponentsClientHttpRequestFactory createRequestFactory() {
try {
SSLContextBuilder sslContext = new SSLContextBuilder();
sslContext.loadTrustMaterial(null, new TrustAllStrategy());
CloseableHttpClient client = HttpClients.custom().setSSLContext(sslContext.build()).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(client);
return requestFactory;
} catch (KeyManagementException | KeyStoreException | NoSuchAlgorithmException var3) {
throw new IllegalStateException("Couldn't create HTTP Request factory ignore SSL cert validity: ", var3);
}
}
#Autowired
public SomeService(RestTemplate restTemplate, ObjectMapper objectMapper) {
this.objectMapper = objectMapper;
this.dimetorURL = dimetorURL;
restTemplate.setRequestFactory(createRequestFactory());
}
public ResponseEntity<ResponseObject> sendRequest(RequestObject requestObject) {
//...
return restTemplate.exchange(url, HttpMethod.GET, ResponseObject.class);
//...
}
}
This is what worked for me on macOS. Replace server-name and server-port with your own.
Run these two commands on your terminal.
Download certificate from the remote server
openssl x509 -in <(openssl s_client -connect server-name:server-port -prexit 2>/dev/null) -out ~/server-name.crt
Import cert to Java keystore
sudo keytool -importcert -file ~/server-name.crt -alias server-name -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
Restart your application and the certs errors should go away!
This works on any OS you just need JDK installed :
Download the certificate from the remote server :
keytool -printcert -rfc -sslserver <your remote server hostname> > /tmp/remorte-cert.crt
Import the certificate to your JDK keystore :
keytool -importcert -file /tmp/remorte-cert.crt -alias <an alias for your remote server> -storepass changeit -keystore "${JAVA_HOME}/lib/security/cacerts" -noprompt
I have an application jar from which I m calling an HTTPS url using DefaultHTTPClient class object but its giving peer not authenticate exception, so I want to sign jar using keystore.
I have .cer file which has public key and I can able to import into keystore but when I use jarsigner tool it says certificate chain not found.you must have private key and associate public key.
I have .pfx file also which is suppose to an private key but I don't know how to import it.can any one able to tell me the steps how to import .pfx file and use in jarsigner.
Correct me if I m wrong somewhere..
UPDATE
As per #Duncan I am able to import .cer file in JVM by referring This Link.. I used bellowed command to import .cer into cacerts
c:\Program Files\Java\jre7\bin>keytool -importcert -alias esbcert -file "e:\Desktop\esbcert\esb.cer" -keystore "c:\Program Files\Java\jre7\lib\security\cacerts"
-storepass changeit
After this I entered 'y' to trust the certificate
Trust this certificate? [no]: y
Certificate was added to keystore
After that I Run my application but it still gives me javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
Stack is as follows :
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
at sun.security.ssl.SSLSessionImpl.getPeerCertificates(Unknown Source)
at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.jav
a:126)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFact
ory.java:572)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnect
ion(DefaultClientConnectionOperator.java:180)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedCli
entConnectionImpl.java:294)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(Default
RequestDirector.java:645)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultReq
uestDirector.java:480)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpCl
ient.java:906)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpCl
ient.java:805)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpCl
ient.java:784)
at testhttps.TestHTTPS.testWithMKCLHTTPClient(TestHTTPS.java:95)
at testhttps.TestHTTPS.main(TestHTTPS.java:49)
My Code is :
String url = "https://domain.org/webapp/transformer/doTransformer/doReg";
try {
HttpPost postRequest = new HttpPost(url);
HttpResponse httpResponse = null;
DefaultHttpClient httpClient = new DefaultHttpClient();
httpResponse = httpClient.execute(postRequest);
} catch (Exception e) {
e.printStackTrace();
}
This exceptions tell that connection made to server URL is not from authenticated client. To resolve this issue we have to import server's public certificate in jre on which java application is runnering to import certificate follow these steps:
As per #Duncan (comment) I am able to import .cer file in JVM by referring This Link.. I used bellowed command to import .cer into cacerts
c:\Program Files\Java\jre7\bin>keytool -importcert -alias esbcert
-file "e:\Desktop\esbcert\esb.cer" -keystore "c:\Program Files\Java\jre7\lib\security\cacerts" -storepass changeit
After this I entered 'y' to trust the certificate
Trust this certificate? [no]: y
Certificate was added to keystore