Spring http client: pkcs12 keystore and trustsrtore on httpclient

Question

Into my application I'm using an HttpClient setting an ssl context:

@Bean
public HttpClient httpClient() throws Exception {
    SSLContext sslContext = SSLContextBuilder.create()
        .loadKeyMaterial(
            new URL(schedulerConfiguration.getKeyStore()),
            schedulerConfiguration.getKeyStorePassword().toCharArray(),
            schedulerConfiguration.getKeyPassword().toCharArray()
        )
        .loadTrustMaterial(
            new URL(schedulerConfiguration.getTrustStore()),
            schedulerConfiguration.getTrustStorePassword().toCharArray()
        )
        .build();

    return HttpClients.custom().setSSLContext(sslContext).build();      
}

As you can see I'm loading a keystore and a truststore.

keystore contains the private key and truststore contains all chain certificates.

I'm running against client connections can't be launched due to:

Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://balancer:8080/token": sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I've built my jks from a .p12 file like this.

In order to build trsutstore:

$ openssl pkcs12 -in fitxers.p12 -nokeys -out cacerts-nokeys.crt
$ keytool -importcert -file cacerts-nokeys.crt -keystore cacerts-pre-splitted.jks

And in order to create my keystore:

$ keytool -importkeystore -srckeystore fitxers.p12 -srcstoretype pkcs12 -destkeystore auth-backoffice-pre.jks -deststoretype jks

Any ideas about what's wrong?

mrkurtan mrkurtan · Accepted Answer · 2019-09-17T10:31:48

I remember having similar issue when not using aliases properly. Are you using aliases in your original p12 file? If so, I'd recommend using the other method for loading the key material with custom PrivateKeyStrategy.

Also take a look when trying to connect your client with vm option:

-Djavax.net.debug=all

You will be able to see a bit of more information. Hopefully this guides you to your solution!

Spring http client: pkcs12 keystore and trustsrtore on httpclient

1 Answers