javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed google recaptcha

1
votes

I have to include google recaptcha in my development(Spring app). I had the google key and secret key for validation and everything was working fine.

Now I am moving the recaptcha validation piece over to another rest services based app, so I can use rest services to leverage/change any keys or url and so on. The setup is I have the rest services app in server1(deployed in weblogic, but added the JAVA_OPTS parameter to use sun libraries) and tomcat with my app on server 2. So when I deploy this and access I get the error when validating the response

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have all the keys synced between server1 and server2 keystores, but still I see the error.

My piece of code where the error is below:

public static final String url = "https://www.google.com/recaptcha/api/siteverify";
    public static final String secret = "";
    private final static String USER_AGENT = "";

    public static boolean verify(String gRecaptchaResponse) throws IOException {
        if (gRecaptchaResponse == null || "".equals(gRecaptchaResponse)) {
            return false;
        }

        try{
        URL obj = new URL(url);
        HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();

        con.setRequestMethod("POST");
        String postParams = "secret=" + secret + "&response="
                + gRecaptchaResponse;
        con.setDoOutput(true);
        DataOutputStream wr = new DataOutputStream(con.getOutputStream()); --------------------------->**This is where the I get the exception**
        wr.writeBytes(postParams);

Am I missing anything here? Thanks.

Note: I can access https://www.google.com/recaptcha/api/siteverify URL via browser.

2
javasslkeyrecaptchasslhandshakeexception

2 Answers

1
votes

I was able to solve this. The site http://magicmonster.com/kb/prg/java/ssl/pkix_path_building_failed.html helped me.

I had to add the google certificate in my weblogic keystore. It was there by default in cacerts, but not in DemoTrust.jks

Thanks again Hrabosch.

0
votes

Are you sure that you have a correct path to cert? When you moved your recaptcha piece, it should be builded on another server (server1?) which have different cert path. This error is just about that. Check (or add) your cert path in JAVA_OPT for build on server1. This error is only about that it cannot find cert in defined path. Check path or permissions. Or you can set a cert path by HARD :) Set for running your application server:

-Djavax.net.ssl.keyStore=path/to/keystore.jks

Or in Java

System.setProperty("javax.net.ssl.trustStore",path_to_your_cacerts_file);