0

I have enterprise Java Custom software, and I have a Gravitee server that hosts my APIs. I have at least 1K computers running this software, and sometimes I get this error:

com.sun.xml.internal.ws.client.ClientTransportException: HTTP transport error : javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I get this error ‘randomly’:

  • 99% of the time I get no error
  • When I get this error on one of the computers on which the software is running, the only way to solve the problem -> restart the software (the error will last the lifetime of the JVM).
  • When this error appears on computer 1, computer 2 can make API calls to the target URL -> no API server downtime/unavailability.

Additional information:

  • the target API does not have a VIP (VirtualIP/LoadBalancer), it's a simple server that always has the same fixed IP.
  • The certificate I add to the KeyStore (cacert) is a self-signed certificate string
  • the URL of the target API is on a local domain (example: myAPI.myDomain.lan) -> so there's no need for a Root Certificate Authority (Root CA)
  • I am sure that my certificate is correct/functional in the KeyStore since, if I remove it, I get same error message
  • I can't find a way to reproduce the problem
  • No Proxy
  • No headdump or memory leak in the logs
  • Java version 1.8.0_231_b11

I have the impression that I've come full circle in solving the problem, and I can't manage to solve it
I need a methodology to approach this problem

Improve this question
3
  • Maybe the certificate is being changed or is expiring? Commented Feb 19 at 7:49
  • @Abra No, because when I restart the software, it works again I think that if the certificate was expired/changed I would have an 100% error rate Commented Feb 19 at 8:05
  • You could try to capture traffic (ie tcpdump) or enable Java SSL debug log for handshakes. Either approach would require some luck if the issue doesn't reproduce consistently. It is impossible for us to know what other components in the network could be related to this issue. There could be some security or network layer hidden somewhere causing issues. Also, not saying it is related to the issue but the JDK 8 release is too old (released in 2019). Have you tried with the latest JDK 8 release? Commented Feb 19 at 16:10
Related questions
1006
"PKIX path building failed" and "unable to find valid certification path to requested target"
645
Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?
321
Unable to find valid certification path to requested target - error even after cert imported
Load 4 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.