无法找到请求目标的有效证书路径 - 签名证书

Question

I am working on a code that connects to slack through a proxy which act as a MITM and replaces slack cert with its own self signed cert. I added proxy's cert into a trust store and configured my RestTemplate to use the trust store:

    def sslContext = new SslContextBuilder().withTrustStore(trustStoreResource, trustStorePassword).build()
    def proxy = proxyEnabled ? new HttpHost(proxyHost, proxyPort) : null
    def httpClient = HttpClients.custom().setProxy(proxy).setSSLContext(sslContext).build()
    def result = new RestTemplate(new HttpComponentsClientHttpRequestFactory(httpClient))

That works fine. However, on my local I don't go through the proxy and connect to slack directly. In other words, the httpClient in the above code would be configured with SSLContext but not proxy. I was expecting this to be fine since Slack's cert is signed with a valid root CA but my code fails to verify Slack's cert.

I am assuming this is because my trustore but I am confused as why this is happening. Is it happening because root CAs are not imported in my trustsore? If so, how would I do that without having to maintain the root CAs?

I understand that locally I can refrain from setting up a trust store but I would like to avoid adding branches in the code if possible.

Answer 1

What I finally ended up doing was to use the implementation in https://gist.github.com/JensRantil/9b7fecb3647ecf1e3076 to combine system's default trust store with mine and then used the following class to build my SSL context. It's a shame HttpClient doesn't offer this but there might be a good reason for it.

import org.springframework.core.io.Resource

import javax.net.ssl.KeyManager
import javax.net.ssl.KeyManagerFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManager
import java.security.KeyStore

class SslContextBuilder {

    private KeyManager[] keyManagers = []
    private TrustManager[] trustManagers = []

    SslContextBuilder withKeyStore(Resource resource, String password) {
        def keyStore = KeyStore.getInstance('JKS')
        keyStore.load(resource.getInputStream(), password.chars)
        KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm())
        kmfactory.init(keyStore, password.chars)
        KeyManager[] kms = kmfactory.getKeyManagers()
        keyManagers += kms ? kms : []

        this
    }

    SslContextBuilder withTrustStore(Resource resource, String password) {
        def trustStore = KeyStore.getInstance('JKS')
        trustStore.load(resource.getInputStream(), password.chars)
        def tss = CompositeX509TrustManager.getTrustManagers(trustStore)
        trustManagers += tss ? tss : []

        this
    }

    SSLContext build() {
        def sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, trustManagers, null)
        sslContext
    }
}