Unable to find valid certification path to requested target как исправить

I am working on a tutorial for REST web services at www.udemy.com (REST Java Web Services). The example in the tutorial said that in order to have SSL, we must have a folder called “trust_store” in my eclipse “client” project that should contain a “key store” file (we had a “client” project to call the service, and “service” project that contained the REST web service – 2 projects in the same eclipse workspace, one the client, the other the service). To keep things simple, they said to copy “keystore.jks” from the glassfish app server (glassfishdomainsdomain1configkeystore.jks) we are using and put it into this “trust_store” folder that they had me make in the client project. That seems to make sense: the self-signed certs in the server’s key_store would correspond to the certs in the client trust_store. Now, doing this, I was getting the error that the original post mentions. I have googled this and read that the error is due to the “keystore.jks” file on the client not containing a trusted/signed certificate, that the certificate it finds is self-signed.

To keep things clear, let me say that as I understand it, the “keystore.jks” contains self-signed certs, and the “cacerts.jks” file contains CA certs (signed by the CA). The “keystore.jks” is the “keystore” and the “cacerts.jks” is the “trust store”. As “Bruno”, a commenter, says above, “keystore.jks” is local, and “cacerts.jks” is for remote clients.

So, I said to myself, hey, glassfish also has the “cacerts.jks” file, which is glassfish’s trust_store file. cacerts.jsk is supposed to contain CA certificates. And apparently I need my trust_store folder to contain a key store file that has at least one CA certificate. So, I tried putting the “cacerts.jks” file in the “trust_store” folder I had made, on my client project, and changing the VM properties to point to “cacerts.jks” instead of “keystore.jks”. That got rid of the error. I guess all it needed was a CA cert to work.

This may not be ideal for production, or even for development beyond just getting something to work. For instance you could probably use “keytool” command to add CA certs to the “keystore.jks” file in the client. But anyway hopefully this at least narrows down the possible scenarios that could be going on here to cause the error.

ALSO: my approach seemed to be useful for the client (server cert added to client trust_store), it looks like the comments above to resolve the original post are useful for the server (client cert added to server trust_store). Cheers.

Eclipse project setup:

• MyClientProject
• src
• test
• JRE System Library
• …
• trust_store
  —cacerts.jks
  —keystore.jks

Snippet from MyClientProject.java file:

static {
  // Setup the trustStore location and password
  System.setProperty("javax.net.ssl.trustStore","trust_store/cacerts.jks");
  // comment out below line
  System.setProperty("javax.net.ssl.trustStore","trust_store/keystore.jks");
  System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
  //System.setProperty("javax.net.debug", "all");

  // for localhost testing only
  javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new javax.net.ssl.HostnameVerifier() {
        public boolean verify(String hostname, javax.net.ssl.SSLSession sslSession) {
          return hostname.equals("localhost");
        }

  });
}

The article presents the steps to import required certificates and enable Java application to connect to Azure SQL DB/Managed Instance. If required certificates are missing on client machine when connecting via AAD authentication, a similar error will be prompted in the application logs:

“SQLServerException: Failed to authenticate the user in Active Directory (Authentication=ActiveDirectoryPassword).
Caused by: ExecutionException: mssql_shaded.com.microsoft.aad.adal4j.AuthenticationException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Caused by: AuthenticationException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. “

This is an issue in Java Certificate Store. As a quick workaround, if you enable TrustServerCertificate=True in the connection string, the connection from JDBC succeeds. When TrustServerCertificate is set to true, the transport layer will use SSL to encrypt the channel and bypass walking the certificate chain to validate trust. If TrustServerCertificate is set to true and encryption is turned on, the encryption level specified on the server will be used even if Encrypt is set to false. The connection will fail otherwise. However, for security considerations, it is not recommended to bypass the certificate validation. Hence, to address the issue, follow the steps below to change the connection string and import the required certificates. 

• Change the connection string to point to the Java certificate path

  String connectionUrl =  “jdbc:sqlserver://localhost:1433;” + 
      “databaseName=AdventureWorks;integratedSecurity=true;” + 
      “encrypt=true; trustServerCertificate=false;” + 
      “trustStore= C:Program FilesJavajdk-14.0.2libcacert;trustStorePassword=changeit”;

• Import all the certificates mentioned in this document.

  Note: To import above certificates into the keystore cacerts, please use below command and please note you must mention truststore and truststore password in the connection string to successfully connect.  
  

keytool -importcert -trustcacerts -alias TLS2 -file “C:UsersDocumentsMicrosoft RSA TLS CA 02.crt” -keystore “C:Program FilesJavajdk-14.0.2libsecuritycacerts”

Certificate was added to keystore.

Давайте рассмотрим решение следующей ошибки:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Данная ошибка  может быть следствием отсутсвия SSL сертификата в хранилище джавы. Добавить его туда можно следующим образом:

1) Открываем в браузере нужный нам ресур

2) Экспортируем сертифика. На примере Google Chrome:

• Открываем консоль разработчика (F12)
• Переходим на вкладку Security -> View certificate -> Detais -> Export
• Сохраняем предлагаемый файл на диск
• Используя утилиту keytool импортируем сертификат в хранилище. Внимание, дефолтный пароль от keystore: changeit

  keytool -import -alias your_alias -file ~/_.google.com.ru -keystore $JAVA_HOME/jre/lib/security/cacerts
  

• Перезапускаем наше приложение.

Необходимо помнить, что при обновлении джавы будет создан новый keystore и процедуру необходимо будет повторить.