How to ignore PKIX path creation failed: sun.security.provider.certpath.SunCertPathBuilderException?

Question

When I tried to send a request to the http server, I received the following exception:

Here is the code I used

URL url = new URL( "https://www.abc.com"); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setRequestMethod("GET"); conn.setDoOutput(true); DataOutputStream wr = new DataOutputStream(conn.getOutputStream()); // wr.writeBytes(params); wr.flush(); wr.close(); BufferedReader br = new BufferedReader(new InputStreamReader( conn.getInputStream())); String line = null; while ((line = br.readLine()) != null) { System.out.println(line); } 

Here is the exception:

 Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1014) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230) at com.amazon.mzang.tools.httpchecker.CategoryYank.getPV(CategoryYank.java:32) at com.amazon.mzang.tools.httpchecker.CategoryYank.main(CategoryYank.java:18) Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217) at sun.security.validator.Validator.validate(Validator.java:218) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185) ... 13 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318) ... 19 more 

The server does not belong to me. Is there a way to ignore this exception?

Answer 1

If you want to ignore the certificate together, see the answer here: Ignore the self-signed ssl certificate using the jersey client

Although this will make your application vulnerable to man-in-the-middle attacks.

Or try adding a certificate to your java store as a trusted certificate. This site may be useful. http://blog.icodejava.com/tag/get-public-key-of-ssl-certificate-in-java/

Here is another thread showing how to add a certificate to your store. Java SSL connect, add the server certificate to the keystore programmatically

Key:

 KeyStore.Entry newEntry = new KeyStore.TrustedCertificateEntry(someCert); ks.setEntry("someAlias", newEntry, null); 

Answer 2

I used the code below to override SSL validation in my project and it worked for me.

 package com.beingjavaguys.testftp; import java.io.InputStreamReader; import java.io.Reader; import java.net.URL; import java.net.URLConnection; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSession; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; import java.security.cert.X509Certificate; /** * Fix for Exception in thread "main" javax.net.ssl.SSLHandshakeException: * sun.security.validator.ValidatorException: PKIX path building failed: * sun.security.provider.certpath.SunCertPathBuilderException: unable to find * valid certification path to requested target */ public class ConnectToHttpsUrl { public static void main(String[] args) throws Exception { /* Start of Fix */ TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted(X509Certificate[] certs, String authType) { } public void checkServerTrusted(X509Certificate[] certs, String authType) { } } }; SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new java.security.SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); // Create all-trusting host name verifier HostnameVerifier allHostsValid = new HostnameVerifier() { public boolean verify(String hostname, SSLSession session) { return true; } }; // Install the all-trusting host verifier HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid); /* End of the fix*/ URL url = new URL("https://nameofthesecuredurl.com"); URLConnection con = url.openConnection(); Reader reader = new InputStreamReader(con.getInputStream()); while (true) { int ch = reader.read(); if (ch == -1) break; System.out.print((char) ch); } } } 

Answer 3

Set the validateTLSCertificates property to validateTLSCertificates for JSoup .

 Jsoup.connect("https://google.com/").validateTLSCertificates(false).get(); 

Answer 4

FWIW, on Ubuntu 10.04.2, LTS installing the ca-certificates-java and ca-cert packages fixed this problem for me.

Answer 5

I got the same error by doing the below spring-boot + RestAssured simple test.

 import org.junit.Test; import org.junit.runner.RunWith; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import static com.jayway.restassured.RestAssured.when; import static org.apache.http.HttpStatus.SC_OK; @RunWith(SpringJUnit4ClassRunner.class) public class GeneratorTest { @Test public void generatorEndPoint() { when().get("https://bal-bla-bla-bla.com/generators") .then().statusCode(SC_OK); } } 

A simple solution in my case is to add 'useRelaxedHTTPSValidations ()'

 RestAssured.useRelaxedHTTPSValidation(); 

Then the test looks like

 import org.junit.Test; import org.junit.runner.RunWith; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import static com.jayway.restassured.RestAssured.when; import static org.apache.http.HttpStatus.SC_OK; @RunWith(SpringJUnit4ClassRunner.class) public class GeneratorTest { @Before public void setUp() { RestAssured.useRelaxedHTTPSValidation(); } @Test public void generatorEndPoint() { when().get("https://bal-bla-bla-bla.com/generators") .then().statusCode(SC_OK); } } 

Answer 6

If you use CloudFoundry, then you will have to explicitly click on the jar along with a keystore that has a certificate.

Answer 7

Try copying Java Cacerts:

cp/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.172-9.b11.fc28.x86_64/jre/lib/security/cacerts $JAVA_HOME/jre/lib/security/cacerts