SSLHandShakeException：PKIX路径构建失败

Question

我已经研究了可能的原因，并按照以下步骤创建了一个包含外部应用程序证书的truststore：

• 从浏览器下载证书链
• 使用
创建truststore

keytool-import-v-trustcacerts-alias mycert-file x_my_cert_location_x-keystore truststore

null

<Connector port="${catalina.port.https}" server="Apache" protocol="HTTP/1.1"
           SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLS"
           clientAuth="false"
           connectionTimeout="20000"
           compression="on"
           compressionMinSize="200"
           compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml"
           enableLookups="false"
           URIEncoding="UTF-8"
           keystoreFile="my_store_location" keystorePass="myPwd"/>

在SSL调试中，我可以看到：

> %% Invalidated: [Session-15, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
> http-nio-8080-exec-9, SEND TLSv1.2 ALERT: fatal, description =
> certificate_unknown http-nio-8080-exec-9, WRITE: TLSv1.2 Alert, length
> = 2 [Raw write]: length = 7 0000: 15 03 03 00 02 02 2E ....... http-nio-8080-exec-9, called closeSocket() http-nio-8080-exec-9,
> handling exception: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find valid certification path to requested target

对我来说毫无意义。我的应用程序在Java1.8.242上。对此有什么建议吗？

Answer 1

该错误表示您缺少试图访问的站点的证书。所以..

>

使用-djavax.net.debug=all启动Java/Tomcat。在日志中，您应该看到这样的行（我删除了时间戳等）：

 trustStore is: {your-cacerts-file} trustStore
 type is: pkcs12
 trustStore provider is: the last modified time is: Tue Feb 02 18:29:33 GMT 2021 
 Reload the trust store
 Reload trust
 Reloaded {x} trust certs adding as trusted certificates
 ( {then you get a big dump of all {x} certs.}

这样，您就可以确定您的cacerts是否真的被阅读。