简体繁体 English

证书存在于cacert文件中，但抛出ssl异常

[英]Certificate is present in cacert file but throwing ssl exception

原文 2016-03-28 20:22:15 6 2 java/ security/ ssl/ https/ glassfish

I have 2 apps installed on 2 different servers (1) hosted in glassfish (2) a batch server (standalone java app). 我在2个不同的服务器上安装了2个应用程序（1）在glassfish中托管（2）批处理服务器（独立的Java应用程序）。 Both apps are using a common java program (in form of a jar file) to call an external server. 这两个应用程序都使用通用的Java程序（以jar文件的形式）来调用外部服务器。 I am using 'CloseableHttpClient' to make connection to that external third party server. 我正在使用“ CloseableHttpClient”建立与该外部第三方服务器的连接。 from my server one (glassfish) I am able to call and get response from the external server but same program on batch server is throwing below SSL exceptoion 从我的服务器（glassfish）中，我能够调用并从外部服务器获得响应，但是批处理服务器上的相同程序却低于SSLexceptoion

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1747) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1209) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:135) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:943) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performIniti javax.net.ssl.SSLHandshakeException：sun.security.validator.ValidatorException：PKIX路径构建失败：sun.security.provider.certpath.SunCertPathBuilderException：在com.sun.net.ssl.internal上找不到指向请求目标的有效证书路径com.sun.net.ssl.internal.ssl.Handshaker上的.ssl.Alerts.getSSLException（Alerts.java:174）在com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal（SSLSocketImpl.java:1747）在com.sun.net.ssl.internal.ssl.Handshaker com.sun.net.ssl.internal.ssl上的.fatalSE（Handshaker.java:241）.com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate（ClientHandshaker）上的.fatalSE（Handshaker.java:235） com.sun.net.ssl.internal.ssl的.java：1209）.ClientHandshaker.processMessage（com.sun.net.ssl.internal.ssl.Handshaker.processLoop（Handshaker.java:593））的com.sun.net.ssl.internal.ssl.Handshaker.process_record（Handshaker.java:529）com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord（SSLSocketImpl.java:943）。 sun.net.ssl.internal.ssl.SSLSocketImpl.performIniti alHandshake(SSLSocketImpl.java:1188) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1215) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1199) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:290) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:259) at org.apache.http.impl.conn.HttpClientConnectionOperator.connect(HttpClientConnectionOperator.java:125) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:319) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:363) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:219) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195) at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:86) at org.apache.http.impl.execcha com.sun.net.ssl.internal.ssl的alHandshake（SSLSocketImpl.java:1188）com.sun.net.ssl.internal.ssl的alHandshake（SSLSocketImpl.java:1215）SSLcommon.ssl.internal.ssl.SSLSocketImpl.startHandshake（SSLSocketImpl。 org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket（SSLConnectionSocketFactory.java:290）处org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket（SSLConnectionSocketFactory.java:259）处的java：1199） org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect（PoolingHttpClientConnectionManager.java:319）的.http.impl.conn.HttpClientConnectionOperator.connect（HttpClientConnectionOperator.java:125）org.apache.http.impl.execchain.MainClientExec在org.apache.http.impl.execchain.MainRoute.Main.org.apache.http.impl.execchain.ProtocolExec.execute（ProtocolExec.java:195）处建立路由（MainClientExec.java:363）），位于org.apache.http.impl.execcha的org.apache.http.impl.execchain.RetryExec.execute（RetryExec.java:86） in.RedirectExec.execute(RedirectExec.java:108) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106) at com.csid.sms.util.postup.PostUpRestClient.executeRequest(PostUpRestClient.java:169) at com.csid.sms.util.postup.PostUpRestClient.executeJsonPost(PostUpRestClient.java:134) at com.csid.sms.util.postup.PostUpRestClient.executeJsonRequest(PostUpRestClient.java:106) at com.csid.sms.util.postup.PostUpEmailRoute.triggerMessage(PostUpEmailRoute.java:213) at itm.monitor.SummaryEmailPostupRoute.triggerMessage(SummaryEmailPostupRoute.java:154) at com.csid.sms.messaging.MessagingHandler.triggerMessage(MessagingHandler.java:60) at itm.monitor.SummaryEmailRoute.sendEmail(SummaryEmailRoute.java:49) at itm.monitor.BatchEmailProcessor.sendEmail(BatchEmailProcessor.java:105) at itm.monitor.Ba org.apache.http.impl.client.InternalHttpClient.doExecute（InternalHttpClient.java:184）中的in.RedirectExec.execute（RedirectExec.java:108）在org.apache.http.impl.client.CloseableHttpClient.execute（CloseableHttpClient。 org.apache.http.impl.client.CloseableHttpClient.execute（CloseableHttpClient.java:106）处的com.csid.sms.util.postup.PostUpRestClient.executeRequest（PostUpRestClient.java:169）处的java：82） .sms.util.postup.PostUpRestClient.executeJsonPost（PostUpRestClient.java:134）位于com.csid.sms.util.postup.PostUpRestClient.executeJsonRequest（PostUpRestClient.java:106）位于com.csid.sms.util.postup.PostUpEmailRoute .imgg.monitor上的.triggerMessage（PostUpEmailRoute.java:213）.SummaryEmailPostupRoute.triggerMessage（SummaryEmailPostupRoute.java:154）位于com.csid.sms.messaging.MessagingHandler.triggerMessage（MessagingHandler.java:60）处于itm.monitor.SummaryEmailRoute。位于itm.monitor.Ba的sendEmail（SummaryEmailRoute.java:49）在itm.monitor.BatchEmailProcessor.sendEmail（BatchEmailProcessor.java:105） tchEmailProcessor.call(BatchEmailProcessor.java:51) at itm.monitor.BatchEmailProcessor.call(BatchEmailProcessor.java:33) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) at java.util.concurrent.FutureTask.run(FutureTask.java:138) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:439) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) at java.util.concurrent.FutureTask.run(FutureTask.java:138) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) at java.lang.Thread.run(Thread.java:662) Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323) at sun.security.validator.PKIXValidator.engineValidate(PKIXV tchEmailProcessor.call（BatchEmailProcessor.java:51）位于itm.monitor.BatchEmailProcessor.call（BatchEmailProcessor.java:33）来自java.util.concurrent.FutureTask $ Sync.innerRun（FutureTask.java:303）在java.util.concurrent的java.util.concurrent.Executors $ RunnableAdapter.call（Executors.java:439）的.FutureTask.run（FutureTask.java:138）的java.util.concurrent.FutureTask $ Sync.innerRun（FutureTask.java:303）的java.util.concurrent.ThreadPoolExecutor $ Worker.runTask（ThreadPoolExecutor.java:895）上的java.util.concurrent.FutureTask.run（FutureTask.java:138）在java.util.concurrent.ThreadPoolExecutor $ Worker.run（ThreadPoolExecutor） java：918）at java.lang.Thread.run（Thread.java:662）原因：sun.security.validator.ValidatorException：PKIX路径构建失败：sun.security.provider.certpath.SunCertPathBuilderException：无法找到有效证书sun.security.validator.PKIXValidator.engineValidate（PKIXV）处sun.security.validator.PKIXValidator.doBuild（PKIXValidator.java:323）上请求目标的路径 alidator.java:217) at sun.security.validator.Validator.validate(Validator.java:218) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1188) ... 37 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318) ... 43 more alidator.java:217）位于sun.security.validator.Validator.validate（Validator.java:218）位于com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate（X509TrustManagerImpl.java:126） com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted（X509TrustManagerImpl.java:249）上的.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted（X509TrustManagerImpl.java:209） .internal.ssl.ClientHandshaker.serverCertificate（ClientHandshaker.java:1188）... 37更多原因：sun.security.provider.certpath.SunCertPathBuilderException：无法在sun.security.provider.certpath上找到指向请求目标的有效证书路径.SunCertPathBuilder.engineBuild（SunCertPathBuilder.java:174）at java.security.cert.CertPathBuilder.build（CertPathBuilder.java:238）at sun.security.validator.PKIXValidator.doBuild（PKIXValidator.java:318）... 43更多

Note - this exception is being thrown only from batch server not from the admin server (hosted in glassfish). 注意-仅从批处理服务器而不是从管理服务器（托管在glassfish中）抛出此异常。

After googling this error found that certificate obtained by external server might not be issued by some trusted authority so i imported certificate by using 'installCert' ( this java program ). 谷歌搜索此错误后，发现外部服务器获得的证书可能不是由某些受信任的机构颁发的，因此我通过使用'installCert'（此java程序）导入了证书。

Now verified the certificate in cacert using keytool command 现在使用keytool命令在cacert中验证证书

keytool -list -keystore cacerts keytool-列表-keystore cacerts

and i can see that external certificate is listed in trusted certificates list. 而且我可以看到外部证书在受信任的证书列表中列出。 but still getting above SSL exception. 但仍然高于SSL异常。

Any thoughts guys? 有什么想法吗？ why i am not getting any sort of SSL expectation from admin server (glassfish) which is also using same java code? 为什么我没有从使用相同Java代码的管理服务器（glassfish）获得任何SSL期望？ Does glassfish automatically imports certificates just like browsers do? glassfish是否会像浏览器一样自动导入证书？

2 个解决方案

Your batch program and your admin application are probably behaving differently because they are using different JRE's. 您的批处理程序和管理应用程序的行为可能有所不同，因为它们使用的是不同的JRE。 Every JRE has its own cacerts. 每个JRE都有自己的证书。

You need to verify if the JRE is really using the trust store where you have imported the certificate. 您需要验证JRE是否确实在使用您将证书导入到的信任库。
Add the JVM runtime argument "-Djavax.net.debug=all" and restart the server. 添加JVM运行时参数“ -Djavax.net.debug = all”，然后重新启动服务器。 This will print the trust stores loaded by the JVM when the server is started. 启动服务器时，这将打印JVM加载的信任库。