Geting PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException after jdk update

1
votes

After updating java version from 1.8.0_231 to 1.8.0_241, I am getting errors related to certificate confiugation.

During spring boot starup I am setting keystore and keystorepass and making a rest call with the help of RestTemplate provided by Spring framework.

After invoking rest service I am getting sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path error.

The same code was working fine with JDK 1.8.0_231. Can any help me what's creating the problem.

I configured keystore and keystorepassowrd as shown below

        System.setProperty("javax.net.ssl.keyStore", environment.getProperty("javax.net.ssl.keyStore"));
        String pswd = null;
        try (BufferedReader br = new BufferedReader(
                new InputStreamReader(new 
        FileInputStream(environment.getProperty("javax.net.ssl.keyStorePassword")), Charset.defaultCharset()))) {
            pswd = br.readLine();
            if (pswd != null) {
                System.setProperty("javax.net.ssl.keyStorePassword", pswd);
            }

        }
2
javaspringspring-bootssl

2 Answers

0
votes

First check the cacert file in JDK 1.8.0_231/jre/lib/security directory and same in jre directory with the same location also. First try to copy the security files and paste into another version of java with the above mentioned location. It should solve the problem.

0
votes

PKIX path building failed

This means there is a issue about trusting certificates. So the issue is with your trust store. As the problem started after updating your JDK, you were probably using the standard java truststore called 'cacerts'. You can find this in JDK_HOME/jre/lib/security/cacerts.

Copy this file from your old to your new JDK and test if the issue is resolved. The best solution is to then just copy the certificates you need from the old cacerts to the new one, instead of overwriting it. This is because the new cacerts file will hold new certificates from trusted root parties that won't be in the old one.

I suggest using a application with a UI, something like https://keystore-explorer.org/, to do this. It let's you drag and drop or copy paste certificates.