Why does a signed certificate give me a handshake failure using Java?

Question

I am accessing a web service. When I go to the web service's URL in my browser, the certificate is signed and automatically is accepted.

What I don't understand is that when I use Java to access the web service I get something along the lines of:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I would imagine this means that the certificate is not signed, but it is.

Doesn't com.sun.net.ssl.internal.ssl go to the certificate authority automatically and check if the certificate is signed? If not, is there something I need to set up in addition in order to do this?

Answer 1

There is more checking than just the signature. The certificate authority that produced the signature must be validated, among other things. Java's list of trusted certificate authorities is different than your browser's. You may need to download the CA cert with your browser and install it with Java's keytool.

Answer 2

您正在连接的Web服务器或URL似乎没有来自授权CA的有效证书。要解决此问题，请参阅此替代解决方案 。