Setting up SSL in Java 6 (GlassFish 3 server)

Question

We have a Java web application running inside GlassFish 3 web server.

Our application connects to a LDAP server for authentication. Now customer is running LDAP on SSL ie ldaps .

So we fetched the certificate from their LDAP server and added it to our trusted certificate. But still we sometime gets:

exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

Further investigation by LDAP admin, his words:

"We added additional servers behind the load balancer. If they trust just the server CERT instead of the CA then you would be experiencing this problem. They should trust the CA or should not perform any certificate validation"

Which means that there are many LDAP server running behind the load balancer and each server has different certificate, and we just trust on one particular certificate.

Now the resolution they say is to trust on the CA and not on individual certificate.

---

NOW at this point I am confused!

Is it the case that we can get a CA certificate and trust on it so that any certificate issued by that CA will be automatically trusted..

If so how to do that?

Will the CA certificate be fetched from the LDAP server or do we have to ask for it?

Or have I created a wrong mind model for this or is there a concept missing?

Also what is "trusted root certificate"?

Answer 1

What they are saying is that the servers are signed using a common CA (like Verisign, Thwate etc). All you need to do is trust that CA (you do this by importing the CA's trusted root certificate).

You will need to find out which CA is being used and then check your cacerts file to see if you already trust the CA (apparently you dont since you are receiving the error). There a number of ways you can find out the CA being used but you can simply ask your LDAP admin which CA is being used. Some companies also use a local CA and this could very well be how your ldap servers are setup.