Wildfly and JDK 1.8 PKIX unable to find valid certification path to requested target

[yadavprem]

Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://example.com/soap/reqest: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)

at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

at java.lang.reflect.Constructor.newInstance(Constructor.java:423)

at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1347)

at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1331)

at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)

at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:632)

at org.jboss.wsf.stack.cxf.saaj.SOAPConnectionImpl.call(SOAPConnectionImpl.java:120)

... 66 more

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:d

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)

at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)

at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)

at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)

at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)

at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)

at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)

at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)

at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1316)

at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1291)

at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)

at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.setupWrappedStream(URLConnectionHTTPConduit.java:174)

at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1290)

at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1246)

at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:201)

at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)

at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)

at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1303)

... 69 more

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)

at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)

at sun.security.validator.Validator.validate(Validator.java:260)

at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)

at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)

at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)

... 88 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)

at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)

at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)

[mchoma]

Your client (cxf) does not trust server certificate you are calling.

[yadavprem]

We are checking this and let you know.

[yadavprem]

mchoma

When we use same code in standalone program its works fine with the given certificates.

But when we deploy it in Wildly (we have tried all version) with jdk 1.8 its not working and shows above error.

[mchoma]

And that "same code" is responsible for loading truststore? Or it depends on jvm wide default SSL Context configuring with javax.net.ssl.* system propertie?

[yadavprem]

The keystore we are using has the certificate and the private key combined together.

We have followed the following approaches :

1) We have tried adding the Keystore to java truststore using below code

          Security.addProvider(new Provider());

          KeyStore keyStore = KeyStore.getInstance("JKS");

          inputStream = new FileInputStream(new File(...));

          keyStore.load(inputStream, password.toCharArray());

          String alg = KeyManagerFactory.getDefaultAlgorithm(); //X509

          KeyManagerFactory fac = KeyManagerFactory.getInstance(alg);

          fac.init(keyStore, password.toCharArray());

          KeyManager[] myKeyManagers = fac.getKeyManagers();

          TrustManager[] trustAllCerts = new TrustManager[]{

               new X509TrustManager() {

               @Override

               public X509Certificate[] getAcceptedIssuers() {

                    return null;

               }

               @Override

               public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {

               }

               @Override

               public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {

               }

          }

     };

     SSLContext sc = SSLContext.getInstance("SSL");

     sc.init(myKeyManagers, trustAllCerts, new SecureRandom());

     HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

     HostnameVerifier hv = new HostnameVerifier() {

          @Override

          public boolean verify(String urlHostName, SSLSession session) {

               if (!urlHostName.equalsIgnoreCase(session.getPeerHost())) {

               }

          return true;

          }

};

HttpsURLConnection.setDefaultHostnameVerifier(hv);

2) Secondly, We added the keystore in JAVA cacerts file.

But both approaches didn't worked for us, although the same approach is working fine in case of JBoss 7 and JDK 1.7 and while running standalone JAVA code on JDK1.8.

[mchoma]

From exception there is used sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124), not your trust all TrustManager custom implementation. Probably something on server overrides your HttpsURLConnection configurations.

Does CXF has something how to configure trustmanager directly? I believe you can still try to configure system property javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword to setup default SSL Context. I would expect CXF picks this up by default.

[yadavprem]

Thanks Martin, we are able to run the application properly on Wildfly 13 using the JVM args.

We provided the following JVM args:

-Djavax.net.debug=ssl

-Djavax.net.ssl.keyStore={JKS_location}

-Djavax.net.ssl.keyStorePassword={keystore_password}

-Djavax.net.ssl.keyStoreType=JKS

No changes were required at JAVA code end.