15

I am getting the following exception:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I did some research and changed my connection code this:

SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {
            public boolean isTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
                return true;
            }
        }).build();

CloseableHttpClient client = HttpClients.custom()
            .setRedirectStrategy(new LaxRedirectStrategy()) 
            .setSslcontext(sslContext)   
            .setConnectionManager(connMgr)
            .build();

This fixed the problem so far, I am no longer getting the exception and the connection works.

The problem arises again when I use the same code in a Servlet running in Tomcat.

Why ?

0

3 Answers 3

4
+50

Try the following code.

import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.X509TrustManager;

public class DummyX509TrustManager implements X509TrustManager {

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }

    @Override
    public void checkServerTrusted(X509Certificate[] paramArrayOfX509Certificate, String paramString)
            throws CertificateException {
    }

    @Override
    public void checkClientTrusted(X509Certificate[] paramArrayOfX509Certificate, String paramString)
            throws CertificateException {
    }
};


final TrustManager[] trustAllCerts = new TrustManager[] { new DummyX509TrustManager() };
try {
    SSLContext sslContext= SSLContext.getInstance("SSL"); 
    sslContext.init(null, trustAllCerts, null);

    CloseableHttpClient client = HttpClients.custom()
        .setRedirectStrategy(new LaxRedirectStrategy()) 
        .setSslcontext(sslContext)   
        .setConnectionManager(connMgr)
        .build();
} catch (KeyManagementException e) {
    throw new IOException(e.getMessage());
} catch (NoSuchAlgorithmException e) {
    throw new IOException(e.getMessage());
}
3
  • I guess this was to tackle the CertificateException, which appeared when I added the keystore and imported the .crt. Turns out I cannot really use this workaround, I'd rather avoid the initial SunCertPathBuilderException.
    – Tim
    Nov 2, 2015 at 11:42
  • Nevertheless I tried your solution and I am getting this error now: java.security.KeyStoreException: problem accessing trust storejava.security.cert.CertificateParsingException: signed overrun, bytes = 266 at com.sun.net.ssl.internal.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:55)
    – Tim
    Nov 2, 2015 at 11:43
  • 1
    Your reply made me check the whole thing and I had an error in my code. Since you are the only one who replied, it is fair that you get the bounty :) Thanks
    – Tim
    Nov 2, 2015 at 12:28
3

Is the website certificate issued by a private/company-owned CA or is it a self-signed?

... new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() ...
  • Trustore is null:
    Did you try to load a keystore/file containing the trusted CAs + their chains?
  • isTrusted always returning "true":
    You're overriding the standard JSSE certificate verification process and trusting all, so no security at all.
  • That exception: means that the certificate verification failed. RootCA, or the whole CA-chain is missing.

So it seems like Tomcat ignored your SSLContext. Used like that, the sslContext is useless anyway. Debugging results? JVM SSL settings? Exception stack trace?

-4

You have developed one servlet. Right? It is nothing but a web page. If you want SSL enabled webpage then you must purchase SSL certificate after that install that certificate. If you don't have that certificate then do use above mentioned codes. Above mentioned codes is appropriate for all security issues.

You have to buy the SSL/TSL certificate from companies like Verisign and Thawte.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.