SSL keys and client auth in Java

Question

I am connecting to a webservice SSL client auth, I set up the keystore by:

System.getProperties().setProperty("javax.net.ssl.keyStore", 
                                  "d:/banking/BankClient/classes/xxcompany/bank/certificate/keystore.jks");
System.getProperties().setProperty("javax.net.ssl.keyStorePassword","password");

When calling the webservice:

GetAccountBalanceResponse resp = services.getAccountBalance(request);

I get a following error

WARNING:Cannot connecti with url: https://[redacted] ; reason: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Exception in thread "main" java.rmi.RemoteException: ; nested exception is: 
    HTTP transport error: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at xxcompany.bank.proxy.runtime.ServicesBinding_Stub.getAccountBalance(ServicesBinding_Stub.java:146)
    at xxcompany.bank.proxy.ServicesPortClient.getAccountBalance(ServicesPortClient.java:48)
    at xx.bank.client.main(client.java:111)
Caused by: HTTP transport error: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at oracle.j2ee.ws.client.http.HttpClientTransport.invokeImpl(HttpClientTransport.java:174)
    at oracle.j2ee.ws.client.http.HttpClientTransport.invoke(HttpClientTransport.java:150)
    at oracle.j2ee.ws.client.StreamingSender._sendImpl(StreamingSender.java:176)
    at oracle.j2ee.ws.client.StreamingSender._send(StreamingSender.java:113)
    at xxcompany.bank.proxy.runtime.ServicesBinding_Stub.getAccountBalance(ServicesBinding_Stub.java:130)
    ... 2 more

The keystore containes the private certificate for the client, the certificate is valid and works fine when used in the browser. How should I fix it?

Many thanks.

Jonas · Accepted Answer · 2011-10-31 09:55:26Z

3

This error occurs when the CA which signed the server cert is either not one of the well know CAs or the public certificate of the CA is not in the trust store of the client. To get around this you will have to add the public certificate of the CA to the trust store of the client.

See unable to find valid certification path to requested target and No more 'unable to find valid certification path to requested target' for detailed instructions.

edited Oct 31, 2011 at 9:55

Jonas

130k103 gold badges330 silver badges408 bronze badges

answered May 9, 2011 at 14:12

Karthik Ramachandran

12.2k10 gold badges49 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

SSL keys and client auth in Java

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related