在 Java 应用程序中构建 PKIX 路径失败

2022-09-01 03:15:09

在将应用程序从 Windows 2000 迁移到 Windows 2008 R2 Server 后,我一直在努力运行我的应用程序近一周。

过程:

  1. 已安装的 Java JDK 1.7.0_25
  2. 将系统环境变量设置为JAVA_HOMEC:\Progra~1\Java\jdk1.7.0_25\
  3. 已将证书导入到 cacerts 中keytool
  4. 已确保证书存在于 中。keytool-list

我试图重复步骤3,以确保我没有搞砸任何东西。InstallCert

上述方法没有解决我的问题,所以我尝试以编程方式进行:

System.setProperty("javax.net.ssl.trustStore",
"C:/Progra~1/Java/jdk1.7.0_25/jre/lib/security/cacerts");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

仍然没有任何运气。我卡住了,不太确定从这里往哪个方向走。

堆栈跟踪:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1886)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:515)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
    at util.SMS.send(SMS.java:93)
    at domain.ActivationSMSSenderMain.sendActivationMessagesToCustomers(ActivationSMSSenderMain.java:80)
    at domain.ActivationSMSSenderMain.<init>(ActivationSMSSenderMain.java:44)
    at domain.ActivationSMSSenderMain.main(ActivationSMSSenderMain.java:341)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1323)
    ... 14 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
    ... 20 more

更新:

System.out.println(System.getProperty("javax.net.ssl.trustStore"));System.out.println(System.getProperty("javax.net.ssl.keyStore"));

返回。null


答案 1

我遇到了类似的问题,其原因和解决方案都相当简单:

主要原因:未使用密钥工具导入正确的证书

注意:仅导入根 CA(或您自己的自签名)证书

注意:不要导入中间的非证书链根证书

imap.gmail.com 解决方案示例

  1. 确定根 CA 证书:

    openssl s_client -showcerts -connect imap.gmail.com:993
    

    在这种情况下,我们发现根CA是Equifax安全证书颁发机构

  2. 下载根 CA 证书
  3. 通过与此处找到的信息进行比较,验证下载的证书是否具有正确的 SHA-1 和/或 MD5 指纹
  4. 进口证书 :javax.net.ssl.trustStore

    keytool -import -alias gmail_imap -file Equifax_Secure_Certificate_Authority.pem
    
  5. 运行您的 Java 代码

答案 2

您已将证书导入到 JDK 中提供的 JRE 的信任库中,但您正在运行直接安装的 JRE 的 java.exe。

编辑

为了清楚起见,并解决下面评论中的误解,您需要将证书导入到您打算使用的JRE文件中,并且很少(如果有的话)是JDK内部的那个,因为客户端通常不会有JDK。下面评论中任何暗示其他情况的东西都应该被忽略,因为它没有在这里表达我的意图。cacerts

一个更好的解决方案是创建自己的信任库,从文件的副本开始,并特别告诉Java通过系统属性使用那个信任库。cacertsjavax.net.ssl.trustStore.

您应该将构建此部分作为构建过程的一部分,以便及时了解由JDK升级引起的文件更改。cacerts