PKIX path building failed. Self-signed SSL certificates - java

I created server and client keystore.jks and truststore.jks pairs.
server-truststore.jks contains client-public.cer, client-truststore.jks contains server-public.cer.
SSL certificates have no CAs, are self-signed ones. If I play the communication locally it works. But after deploying my server I get the exception:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I've tried to put my server/client certificates into carcerts of java security, it didn't help.
The communication only works if I call my WS from SOAP UI. (For SOAP UI I don't need to use truststore.jks)
I checked it out with a famous SSLPoke.class
$ java SSLPoke HOST 443
Successfully connected
$ java -Djavax.net.ssl.trustStore=truststore.jks SSLPoke HOST 443
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
What could solve it?

Related

Certificate chain handed over to graylog for internal communication doesn't work

I have stored a correct certificate in the Graylog configuration file, in the correct format. The web interface is also accessible via https. However, I get the following error message:
WARN [ProxiedResource] Unable to call https://<...>/api/system/metrics/multiple on node <...>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
WARN [ProxiedResource] Unable to call https://<...>/api/system/inputstates on node <...>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I work on Debian 10 with Graylog 5.0
My Server conf
hope someone can help me
I have stored a correct certificate in the Graylog configuration file, in the correct format. The web interface is also accessible via https. However, I get the following error message.
I have also packed the certificate chain into the cacerts file from elastic via keytool
Last time I was able to work around it by adding a local dns entry to the hosts file, which set the Hostname to the public IP (the certificate did not contain the ip. But now it is)
or do I have the wrong approach?
At first search for the cacerts for graylog
sudo find / -name cacerts
then put in the cert chain via keytool
sudo keytool -import -keystore /usr/share/graylog-server/jvm/lib/security/cacerts -file /etc/ssl/certs/gray.pem
Once this was done it started working.

Tomcat is unable to find valid certification path to requested target after the certificate is added to JVM keystore

I'm receiving this exception when I try to access a CAS server
12:27:35.216 [https-jsse-nio-8080-exec-6] DEBUG o.j.c.c.v.Cas20ServiceTicketValidator - Constructing validation url: https://localhost:8090/cas-server-webapp-4.0.0/serviceValidate?&ticket=ST-2-I1EbyRdw9aOr4xTW9cmQ-localhost&service=https%3A%2F%2Flocalhost%3A8080%2FIDwebapp%2Fj_spring_cas_security_check
12:27:35.216 [https-jsse-nio-8080-exec-6] DEBUG o.j.c.c.v.Cas20ServiceTicketValidator - Retrieving response from server.
12:27:35.352 [https-jsse-nio-8080-exec-6] ERROR o.j.c.c.v.Cas20ServiceTicketValidator - javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I have followed this guide https://github.com/escline/InstallCert to install the certificate... and effectly it added to the JVM's cacert keystore:
java InstallCert localhost:8090
But the problem arrises when I use Tomcat; it continues generating the same exception.
In the Web browser an HTTP Status 401 - Unauthorized error is showed:

No issuer certificate for certificate in certification path found

I am trying to build an app for Token Browser, I have followed all the instructions. Created a Docker Environment and entered all the configuration. When I'm running the docker-compose up I receive the following error. Any help would be greatly appreciated.
org.whispersystems.signalservice.api.push.exceptions.PushNetworkException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: java.security.cert.CertPathBuilderException: No issuer certificate for certificate in certification path found.
Notes: Received this on both Linux 16.04 (Virtual Box) and Windows 10 Home.

Issue when using InstallCert For SSLCertification

I was trying to send a post request on a url from server then it showed following errors
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
Then I found about InstallCert.java( https://www.cs.ucsb.edu/~pconrad/cs56/examples/ldap/SimpleQuery/InstallCert.java ) which will allow my host and port to send the request. But when I was trying to run it on server it also showed some errors.
ubuntu#ip-172-31-28-14:/var/lib/tomcat7/webapps$ java InstallCert 52.39.134.231:8080
Loading KeyStore /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts...
Opening connection to 52.39.134.231:8080...
Starting SSL handshake...
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java:671)
at sun.security.ssl.InputRecord.read(InputRecord.java:504)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:946)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1355)
at InstallCert.main(InstallCert.java:91)
Could not obtain server certificate chain
And now I don't know what to do to send my request.

SSLHandshakeException cannot authenticate user

I get this error while launching the application.
org.jboss.mq.SpyJMSException: Cannot authenticate user; - nested throwable: (javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)
org.jboss.mq.SpyJMSException: Cannot authenticate user; - nested throwable: (javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)
I set my certificate path by System.setProperty("javax.net.ssl.trustStore", "Path to certificate)..
But this is not working me..Also I have imported the certificate to the "cacerts" of Java Home. But still I am getting the error..
Any help would be appericiated...
The application authenticating the user has a Java keystore as its trust store. The trust store has to contain (as a trusted certificate) the certificate authority that signed the user's certificate. Put the certificate authority in a base-64 ca.cer file and use keytool -import -keystore YourKeystore -alias ca -file ca.cer -trustcacerts.

Categories