HTTPs HTTPURLConnection Issue

Question

I have a REST API say https://testing.com/ap//v1/test/23123 . This is my Java code:

URL restServiceURL = new URL(targetURL);

Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress("100.3.4.54", 9128));
HttpURLConnection httpConnection = (HttpURLConnection) restServiceURL.openConnection(proxy);
httpConnection.setRequestMethod("GET");
httpConnection.setRequestProperty("Accept", "application/json");

if (httpConnection.getResponseCode() != 200) {
    throw new RuntimeException("HTTP GET Request Failed with Error code : "
            + httpConnection.getResponseCode());
}

BufferedReader responseBuffer = new BufferedReader(new InputStreamReader(
        (httpConnection.getInputStream())));

This throws an java exception:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: CA key usage check failed: keyCertSign bit is not set
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1591)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:975)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)

Is there any way to bypass this https validation? What is the best way to fix this?

Answer 1

The server certificate is invalid. A signing certificate was presented that isn't a signing certificate, that is to say it doesn't have the keyCertSign bit set.