unable to find valid certification path to requested target


在配置测试环境的时候报告unable to find valid certification path to requested target错误。

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323)

    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217)

    at sun.security.validator.Validator.validate(Validator.java:218)

    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)

    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)

    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)

    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)

    ... 47 more

网上一搜，找到了解决办法。

当java客户端请求实现https协议的服务时，出现异常：'unable to find valid certification path to requested target'

是因为服务期端的证书没有被认证，需要做的是把服务端证书导入到java keystore。可以附件中的java类实现。

使用方法： java InstallCert <host>[:port] [passphrase]      

这个java类会打开一个连接到你指定的host，开始握手过程。如果出现异常会打印到控制台并且会显示服务端所使用的证书，此时它会问你是否要把证书加入到你的keystore。

如果你不想加，输入"q",否则输入"1".

当你输入"1"后，InstallCert.java 会显示证书的有关信息，然后把证书导入到一个名为"jssecacerts"的keystore中(当前目录），只需要把这个文件拷贝到 JAVA_HOME/jre/lib/security目录中，重命名为"cacerts". [注意不一定是Java_home里，主要看project 里面的build_path里的jre位置]

package com.bleum;

import java.io.BufferedReader;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStream;

import java.security.KeyStore;

import java.security.MessageDigest;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLSocketFactory;

import javax.net.ssl.TrustManager;

import javax.net.ssl.TrustManagerFactory;

import javax.net
4000
.ssl.X509TrustManager;

public class InstallCert {

 // 文件默认生成在项目根目录下

 public static void main(String[] args) throws Exception {

  String host = "gateway-staging-sbux.wiredcraft.net";

  int port = 443;

  char[] passphrase;

  passphrase = "changeit".toCharArray();

  File file = new File("jssecacerts");

  if (file.isFile() == false) {

   char SEP = File.separatorChar;

   File dir = new File(System.getProperty("java.home") + SEP + "lib" + SEP + "security");

   file = new File(dir, "jssecacerts");

   if (file.isFile() == false) {

    file = new File(dir, "cacerts");

   }

  }

  System.out.println("Loading KeyStore " + file + "...");

  InputStream in = new FileInputStream(file);

  KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

  ks.load(in, passphrase);

  in.close();

  SSLContext context = SSLContext.getInstance("TLS");

  TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

  tmf.init(ks);

  X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];

  SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);

  context.init(null, new TrustManager[] { tm }, null);

  SSLSocketFactory factory = context.getSocketFactory();

  System.out.println("Opening connection to " + host + ":" + port + "...");

  SSLSocket socket = (SSLSocket) factory.createSocket(host, port);

  socket.setSoTimeout(10000);

  try {

   System.out.println("Starting SSL handshake...");

   socket.startHandshake();

   socket.close();

   System.out.println();

   System.out.println("No errors, certificate is already trusted");

  } catch (SSLException e) {

   System.out.println();

   e.printStackTrace(System.out);

  }

  X509Certificate[] chain = tm.chain;

  if (chain == null) {

   System.out.println("Could not obtain server certificate chain");

   return;

  }

  BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));

  System.out.println();

  System.out.println("Server sent " + chain.length + " certificate(s):");

  System.out.println();

  MessageDigest sha1 = MessageDigest.getInstance("SHA1");

  MessageDigest md5 = MessageDigest.getInstance("MD5");

  for (int i = 0; i < chain.length; i++) {

   X509Certificate cert = chain[i];

   System.out.println(" " + (i + 1) + " Subject " + cert.getSubjectDN());

   System.out.println("   Issuer  " + cert.getIssuerDN());

   sha1.update(cert.getEncoded());

   System.out.println("   sha1    " + toHexString(sha1.digest()));

   md5.update(cert.getEncoded());

   System.out.println("   md5     " + toHexString(md5.digest()));

   System.out.println();

  }

  System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");

  String line = reader.readLine().trim();

  int k;

  try {

   k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;

  } catch (NumberFormatException e) {

   System.out.println("KeyStore not changed");

   return;

  }

  X509Certificate cert = chain[k];

  String alias = host + "-" + (k + 1);

  ks.setCertificateEntry(alias, cert);

  OutputStream out = new FileOutputStream("jssecacerts");

  ks.store(out, passphrase);

  out.close();

  System.out.println();

  System.out.println(cert);

  System.out.println();

  System.out.println("Added certificate to keystore 'jssecacerts' using alias '" + alias + "'");

 }

 private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

 private static String toHexString(byte[] bytes) {

  StringBuilder sb = new StringBuilder(bytes.length * 3);

  for (int b : bytes) {

   b &= 0xff;

   sb.append(HEXDIGITS[b >> 4]);

   sb.append(HEXDIGITS[b & 15]);

   sb.append(' ');

  }

  return sb.toString();

 }

 private static class SavingTrustManager implements X509TrustManager {

  private final X509TrustManager tm;

  private X509Certificate[] chain;

  SavingTrustManager(X509TrustManager tm) {

   this.tm = tm;

  }

  public X509Certificate[] getAcceptedIssuers() {

   throw new UnsupportedOperationException();

  }

  public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {

   throw new UnsupportedOperationException();

  }

  public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {

   this.chain = chain;

   tm.checkServerTrusted(chain, authType);

  }

 }

}