解决PKIX:unable to find valid certification path to requested target 的问题
这两天在twitter服务器上忽然遇到这样的异常:
e: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
经过检查确认,完整的异常信息应该如下:
Java类已经无法下载了。。。。历经N次的google,终于找到该文件了,不敢独享,记录于此。
问题的根本是:
缺少安全证书时出现的异常。
解决问题方法:
将你要访问的webservice/url....的安全认证证书导入到客户端即可。
以下是获取安全证书的一种方法,通过以下程序获取安全证书:
- /*
- * Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * - Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * - Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * - Neither the name of Sun Microsystems nor the names of its
- * contributors may be used to endorse or promote products derived
- * from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
- * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- import java.io.BufferedReader;
- import java.io.File;
- import java.io.FileInputStream;
- import java.io.FileOutputStream;
- import java.io.InputStream;
- import java.io.InputStreamReader;
- import java.io.OutputStream;
- import java.security.KeyStore;
- import java.security.MessageDigest;
- import java.security.cert.CertificateException;
- import java.security.cert.X509Certificate;
- import javax.net.ssl.SSLContext;
- import javax.net.ssl.SSLException;
- import javax.net.ssl.SSLSocket;
- import javax.net.ssl.SSLSocketFactory;
- import javax.net.ssl.TrustManager;
- import javax.net.ssl.TrustManagerFactory;
- import javax.net.ssl.X509TrustManager;
- public class InstallCert {
- public static void main(String[] args) throws Exception {
- String host;
- int port;
- char[] passphrase;
- if ((args.length == 1) || (args.length == 2)) {
- String[] c = args[0].split(":");
- host = c[0];
- port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
- String p = (args.length == 1) ? "changeit" : args[1];
- passphrase = p.toCharArray();
- } else {
- System.out
- .println("Usage: java InstallCert <host>[:port] [passphrase]");
- return;
- }
- File file = new File("jssecacerts");
- if (file.isFile() == false) {
- char SEP = File.separatorChar;
- File dir = new File(System.getProperty("java.home") + SEP + "lib"
- + SEP + "security");
- file = new File(dir, "jssecacerts");
- if (file.isFile() == false) {
- file = new File(dir, "cacerts");
- }
- }
- System.out.println("Loading KeyStore " + file + "...");
- InputStream in = new FileInputStream(file);
- KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
- ks.load(in, passphrase);
- in.close();
- SSLContext context = SSLContext.getInstance("TLS");
- TrustManagerFactory tmf = TrustManagerFactory
- .getInstance(TrustManagerFactory.getDefaultAlgorithm());
- tmf.init(ks);
- X509TrustManager defaultTrustManager = (X509TrustManager) tmf
- .getTrustManagers()[0];
- SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
- context.init(null, new TrustManager[] { tm }, null);
- SSLSocketFactory factory = context.getSocketFactory();
- System.out
- .println("Opening connection to " + host + ":" + port + "...");
- SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
- socket.setSoTimeout(10000);
- try {
- System.out.println("Starting SSL handshake...");
- socket.startHandshake();
- socket.close();
- System.out.println();
- System.out.println("No errors, certificate is already trusted");
- } catch (SSLException e) {
- System.out.println();
- e.printStackTrace(System.out);
- }
- X509Certificate[] chain = tm.chain;
- if (chain == null) {
- System.out.println("Could not obtain server certificate chain");
- return;
- }
- BufferedReader reader = new BufferedReader(new InputStreamReader(
- System.in));
- System.out.println();
- System.out.println("Server sent " + chain.length + " certificate(s):");
- System.out.println();
- MessageDigest sha1 = MessageDigest.getInstance("SHA1");
- MessageDigest md5 = MessageDigest.getInstance("MD5");
- for (int i = 0; i < chain.length; i++) {
- X509Certificate cert = chain[i];
- System.out.println(" " + (i + 1) + " Subject "
- + cert.getSubjectDN());
- System.out.println(" Issuer " + cert.getIssuerDN());
- sha1.update(cert.getEncoded());
- System.out.println(" sha1 " + toHexString(sha1.digest()));
- md5.update(cert.getEncoded());
- System.out.println(" md5 " + toHexString(md5.digest()));
- System.out.println();
- }
- System.out
- .println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
- String line = reader.readLine().trim();
- int k;
- try {
- k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
- } catch (NumberFormatException e) {
- System.out.println("KeyStore not changed");
- return;
- }
- X509Certificate cert = chain[k];
- String alias = host + "-" + (k + 1);
- ks.setCertificateEntry(alias, cert);
- OutputStream out = new FileOutputStream("jssecacerts");
- ks.store(out, passphrase);
- out.close();
- System.out.println();
- System.out.println(cert);
- System.out.println();
- System.out
- .println("Added certificate to keystore 'jssecacerts' using alias '"
- + alias + "'");
- }
- private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();
- private static String toHexString(byte[] bytes) {
- StringBuilder sb = new StringBuilder(bytes.length * 3);
- for (int b : bytes) {
- b &= 0xff;
- sb.append(HEXDIGITS[b >> 4]);
- sb.append(HEXDIGITS[b & 15]);
- sb.append(' ');
- }
- return sb.toString();
- }
- private static class SavingTrustManager implements X509TrustManager {
- private final X509TrustManager tm;
- private X509Certificate[] chain;
- SavingTrustManager(X509TrustManager tm) {
- this.tm = tm;
- }
- public X509Certificate[] getAcceptedIssuers() {
- throw new UnsupportedOperationException();
- }
- public void checkClientTrusted(X509Certificate[] chain, String authType)
- throws CertificateException {
- throw new UnsupportedOperationException();
- }
- public void checkServerTrusted(X509Certificate[] chain, String authType)
- throws CertificateException {
- this.chain = chain;
- tm.checkServerTrusted(chain, authType);
- }
- }
- }
编译InstallCert.java,然后执行:java InstallCert hostname,比如:
java InstallCert www.twitter.com
会看到如下信息:
- java InstallCert www.twitter.com
- Loading KeyStore /usr/java/jdk1.6.0_16/jre/lib/security/cacerts...
- Opening connection to www.twitter.com:443...
- Starting SSL handshake...
- javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
- at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1476)
- at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
- at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
- at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:846)
- at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)
- at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)
- at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)
- at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:815)
- at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1025)
- at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1038)
- at InstallCert.main(InstallCert.java:63)
- Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:221)
- at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:145)
- at sun.security.validator.Validator.validate(Validator.java:203)
- at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:172)
- at InstallCert$SavingTrustManager.checkServerTrusted(InstallCert.java:158)
- at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLContextImpl.java:320)
- at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:839)
- ... 7 more
- Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:236)
- at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:194)
- at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:216)
- ... 13 more
- Server sent 2 certificate(s):
- 1 Subject CN=www.twitter.com, O=example.com, C=US
- Issuer CN=Certificate Shack, O=example.com, C=US
- sha1 2e 7f 76 9b 52 91 09 2e 5d 8f 6b 61 39 2d 5e 06 e4 d8 e9 c7
- md5 dd d1 a8 03 d7 6c 4b 11 a7 3d 74 28 89 d0 67 54
- 2 Subject CN=Certificate Shack, O=example.com, C=US
- Issuer CN=Certificate Shack, O=example.com, C=US
- sha1 fb 58 a7 03 c4 4e 3b 0e e3 2c 40 2f 87 64 13 4d df e1 a1 a6
- md5 72 a0 95 43 7e 41 88 18 ae 2f 6d 98 01 2c 89 68
- Enter certificate to add to trusted keystore or 'q' to quit: [1]
输入1,回车,然后会在当前的目录下产生一个名为“ssecacerts”的证书。
将证书拷贝到$JAVA_HOME/jre/lib/security目录下,或者通过以下方式:
System.setProperty("javax.net.ssl.trustStore", "你的jssecacerts证书路径");
注意:因为是静态加载,所以要重新启动你的Web Server,证书才能生效。
解决PKIX:unable to find valid certification path to requested target 的问题的更多相关文章
- PKIX: unable to find valid certification path to requested target
// Create a trust manager that does not validate certificate chains TrustManager[] trustAllCerts = n ...
- 解决 java 使用ssl过程中出现"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
今天,封装HttpClient使用ssl时报一下错误: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorExc ...
- 解决PKIX(PKIX path building failed) 问题 unable to find valid certification path to requested target
最近在写java的一个服务,需要给远程服务器发送post请求,认证方式为Basic Authentication,在请求过程中出现了 PKIX path building failed: sun.se ...
- Pop3_解决PKIX:unable to find valid certification path to requested target 的问题
最近有公司pop3协议接收pp邮箱出现异常,连不上服务器,错误内容: e: sun.security.validator.ValidatorException: PKIX path building ...
- https编程遇到PKIX:unable to find valid certification path to requested target 的问题
https编程遇到PKIX:unable to find valid certification path to requested target 的问题 2016-12-01 解决方案见:解决PKI ...
- 解决flutter:unable to find valid certification path to requested target 的问题
1.问题 周末在家想搞搞flutter,家里电脑是windows的,按照官网教程一步步安装好以后,创建flutter工程,点击运行,一片红色弹出来,WTF? PKIX path building fa ...
- Maven:sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
还是记录使用 maven 时遇到的问题. 一.maven报错 maven package 进行打包时出现了以下报错: Non-resolvable parent POM for com.wpbxin: ...
- Flutter配置环境报错“PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target”
背景:最近看了很多Flutter漂亮的项目,想要尝试一下.所有环境都搭建好之后,按照文档一步一步配置(抄袭),但始终报如下图错误. PKIX path building failed: sun.sec ...
- PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
注:网上搜来的快照,暂未验证 在java代码中请求https链接的时候,可能会报下面这个错误javax.net.ssl.SSLHandshakeException: sun.security.vali ...
随机推荐
- 【记录】xUnit for vs2012/vs2013
关于 NUint 以及单元测试的相关内容,可以参考:[单元测试]NUint使用详解及Visual Studio配置. xUnit 是 NUint 的进化版本,使用方法和 NUint 类似,首先下载安装 ...
- PHPStorm如何配置,phpstorm的mac配置文件目录
PHPStorm的配置分为2大类:项目配置和IDE配置. 项目配置(设置),主要是配置具体项目.IDE 配置(设置),通用的设置会应用到所有的项目上. 项目配置每个项目的配置存储在项目所在目录的 .i ...
- Spring笔记--xml配置文件详解
1:bean的基本属性配置: <!-- id是bean的标识符,必须唯一,如果没有配置id,name默认为标识符 如果配置了id,有配置了name,那么name为别名 name可以设置多个别名, ...
- Cesium原理篇:6 Render模块(3: Shader)
在介绍Renderer的第一篇,我就提到WebGL1.0对应的是OpenGL ES2.0,也就是可编程渲染管线.之所以单独强调这一点,算是为本篇埋下一个伏笔.通过前两篇,我们介绍了VBO和Textur ...
- 原创:微信小程序源码解说:石头剪刀布(附源码下载)
我的博客:来源链接 昨天看有个石头剪刀布的练习,就拿出来做了一下,布局的代码浪费了很多时间,果然CSS这块的还不是很熟练,下面直接上图上代码了. JS: var numAi = 0 var timer ...
- 初次使用AngularJS中的ng-view,路由控制
AngularJS中的route可以控制页面元素的改变,使多页面变成一个单页面 第一步:引入必要的js: <script src="js/lib/angular.js"> ...
- JAVA字符串格式化-String.format()的使用
String类的format()方法用于创建格式化的字符串以及连接多个字符串对象.熟悉C语言的同学应该记得C语言的sprintf()方法,两者有类似之处.format()方法有两种重载形式. form ...
- [Tool] csdn客户端开发(非官方版)
偶尔间看到一篇博客[清山博客]里讲述了他自己开发的一个CSDN博客客户端,并去下载体验了一下,然后就自己手痒也要开发一下 先看看结果图: 在文章列表里,鼠标右键可以操作[置顶.删除.评论权限]: 下面 ...
- [System] CentOS虚拟机系统克隆后的网络配置
VMware Workstation 虚拟机在进行克隆 CentOS 系统之后,在克隆机上配置网卡时,会出现一些细节问题,讨论一二. 一.情景描述 克隆机上默认由 NetworkManager 服务管 ...
- DevExtreme 学习应用[1]
DevExtreme学习开发 [1] 用HTML开发手机应用,看一哈帮助文档觉得还很不错. 在开发前一定要安装DevExteme 下载连接地址: ftp://211.101.1.108/DevExp ...