PKIXパス構築に失敗しました（SSLHandshake Exception）

Question

AWS上でTomcat 8上で動作するJavaで書かれた一連の「ラッパー」サービスが、クライアントの一連のMIMEサービスを呼び出します。私はこれを呼び出すと

@Path("/files/payloadid/{id}") 
@GET 
@Produces(MediaType.TEXT_PLAIN) 
public Response getFileListByPayloadID(@PathParam("id") String payloadId) throws JSONException 
{ 
    logger.debug(">>>ENTERED getFileListByPayloadID()"); 

    DirectConnectService service = new DirectConnectService(); 
    CloseableHttpResponse httpResponse = null; 
    String result = null; 

    HttpEntity reqEntity = MultipartEntityBuilder 
     .create() 
     .addTextBody("UserName", "xxxxxxxx") 
     .addTextBody("Password", "xxxxxxxx") 
     .addTextBody("PayloadID", payloadId) 
     .build(); 

    CloseableHttpClient httpClient = HttpClients.createDefault(); 
    HttpPost httpPost = new HttpPost("https://services.kymmis.com/BatchUploadDownloadServiceApp/BatchService.svc/mime/GetDownloadFilesList/ByPayloadID"); 
    httpPost.setEntity(reqEntity); 
    try { 
     httpResponse = httpClient.execute(httpPost); 
     result = service.stringifyEntity(httpResponse.getEntity()); 
     result = result.substring(result.indexOf("<"), result.lastIndexOf(">")+1); 
    } catch (IOException e) { 
     e.printStackTrace(); 
    } finally { 
     try{httpClient.close();}catch(Exception e){}; 
    } 

    Response response = Response.status(200).entity(result).build(); 

    logger.debug("<<<EXITED getFileListByPayloadID()"); 
    return response; 
} 

は、私はかなりの時間のために働いてきた次の例外を取り戻す：私は彼らのサービスを呼び出そうとすると、私はSSLHandshakeException

サンプル・ラッパーコードを以下に示し取り戻しますここに。私のキーストアに証明書を追加する必要があると私は思っていますが、私がクライアントに連絡したとき、彼らには証明書がないと言われました...（もちろん、証明書に関する悪い情報を与える可能性があります...）

ご協力いただければ幸いです！それは私が実際に証明書の問題を持っていないために接続しようとしたサーバーのように見えるこの特定のケースでOK

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
     at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) 
     at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) 
     at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) 
     at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) 
     at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) 
     at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) 
     at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) 
     at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) 
     at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) 
     at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394) 
     at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353) 
     at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134) 
     at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353) 
     at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380) 
     at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) 
     at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184) 
     at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88) 
     at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) 
     at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) 
     at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) 
     at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107) 
     at com.alveohealth.DirectConnect.getFileListByPayloadID(DirectConnect.java:107) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
     at java.lang.reflect.Method.invoke(Method.java:498) 
     at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) 
     at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) 
     at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) 
     at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:160) 
     at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) 
     at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) 
     at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) 
     at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) 
     at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) 
     at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) 
     at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) 
     at org.glassfish.jersey.internal.Errors.process(Errors.java:315) 
     at org.glassfish.jersey.internal.Errors.process(Errors.java:297) 
     at org.glassfish.jersey.internal.Errors.process(Errors.java:267) 
     at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) 
     at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) 
     at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) 
     at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:473) 
     at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:427) 
     at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:388) 
     at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:341) 
     at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:228) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) 
     at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) 
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:474) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) 
     at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) 
     at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783) 
     at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) 
     at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:789) 
     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1437) 
     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
     at java.lang.Thread.run(Thread.java:745) 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) 
     at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) 
     at sun.security.validator.Validator.validate(Validator.java:260) 
     at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
     at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
     at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
     at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) 
     ... 68 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
     at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) 
     at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) 
     at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) 
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) 
     ... 74 more 

Answer 1

。私は彼らのサポートに連絡してきたし、彼らは問題の解決に取り組んでいる

opensslのs_client -connect services.kymmis.com:443 -showcerts

opensslコマンドを使用してこれを見つけました。一方

私は、接続をテストするためにこれをやって接続することができました：

注意：あなたは、基本的にすべてを信頼するように、それを伝えることで、トラストマネージャを無効にしているように私はこれを行うことはお勧めしません。これは単に接続をテストすることでした。

public void hackHttpURLConnection() { 
     // Create a trust manager that does not validate certificate chains 
     TrustManager[] trustAllCerts = new TrustManager[]{ 
      new X509TrustManager() { 
       public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
        return null; 
       } 
       public void checkClientTrusted(
        java.security.cert.X509Certificate[] certs, String authType) { 
       } 
       public void checkServerTrusted(
        java.security.cert.X509Certificate[] certs, String authType) { 
       } 
      } 
     }; 

     // Install the hacked trust manager 
     try { 
      SSLContext sc = SSLContext.getInstance("SSL"); 
      sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
      HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); 
     } catch (Exception e) { 
     } 
    }