web service on PAT port over secure connection

Question

I have an issue at production when connecting to web service.

Below is the error message

Error: Unable to invoke endpoint URI " https://example.com/WebserviceLibrary/test.asmx " successfully due to: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This is failing with SOA tool when submitting jobs. Web server is hosted on IIS under secure port

Information on SOA:

SOA create WSDL client at runtime and use binding port endpoint URL of the service from the WSDL retrieved at run time.

SOA uses the concept of discovering the service from registry then reading the WSDL retrieved and call the service at mentioned endpoint in WSDL retrieved.

I see WSDL client created at runtime by SOA has location URI " https://example.com/WebserviceLibrary/test.asmx "

They have an external PAT port involved. Server has a PAT port say 11560. The URL with IP and PAT Port 11560 is working fine and able to connect the URL. They can test it through curl command or any non SOA java codes.

They could connect to this URI " https://example.com:11560/WebserviceLibrary/test.asmx "

This issue is not occurring when tested internally on our environments as external PAT port is not involved.

I suspect PAT port could be the reason for this issue but not sure how that can happen.

Though error message says as some sort of cert issue but they could connect and test with IP and port on https.

I think one way to resolve this issue is hosting web server on IIS under PAT port. Do you guys have any alternate solution for this?

Thanks in advance!

Answer 1

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

As far as I know, when trying to open an SSL connection to a host using JSSE. What this usually means is that the server is using a test certificate (possibly generated using keytool) rather than a certificate which is inside the system certificate store.So You could try to edit JAVA_HOME/jre/lib/security/cacerts file or run you application with -Djavax.net.ssl.trustStore parameter to add the certficate.