SSL錯誤：無法找到要求的目標的有效證書路徑

Question

我試圖通過我需要證書的服務器連接到一個URL。我已經將我的客戶端身份驗證證書導入到{JAVA_HOME}/jre/bin/security/cacerts，並且我已將它放入Jboss/bin和jboss/server/conf /中的密鑰庫中，然後重新啓動我的服務器，但它仍然給我以下錯誤。

Caused by: java.io.IOException: Could not transmit message 
    at org.jboss.ws.core.client.HTTPRemotingConnection.invoke(HTTPRemotingConnection.java:265) 
    at org.jboss.ws.core.client.SOAPProtocolConnectionHTTP.invoke(SOAPProtocolConnectionHTTP.java:71) 
    at org.jboss.ws.core.CommonClient.invoke(CommonClient.java:340) 
    at org.jboss.ws.core.jaxws.client.ClientImpl.invoke(ClientImpl.java:290) 
    ... 40 more 
Caused by: org.jboss.remoting.CannotConnectException: Can not connect http client invoker after 1 attempt(s) 
    at org.jboss.remoting.transport.http.HTTPClientInvoker.makeInvocation(HTTPClientInvoker.java:249) 
    at org.jboss.remoting.transport.http.HTTPClientInvoker.transport(HTTPClientInvoker.java:161) 
    at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:165) 
    at org.jboss.remoting.Client.invoke(Client.java:1724) 
    at org.jboss.remoting.Client.invoke(Client.java:629) 
    at org.jboss.ws.core.client.HTTPRemotingConnection.invoke(HTTPRemotingConnection.java:243) 
    ... 43 more 
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1611) 
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187) 
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1035) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:124) 
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516) 
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1139) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123) 
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) 
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) 
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:904) 
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230) 
    at org.jboss.remoting.transport.http.HTTPClientInvoker.getOutputStream(HTTPClientInvoker.java:1214) 
    at org.jboss.remoting.transport.http.HTTPClientInvoker.useHttpURLConnection(HTTPClientInvoker.java:334) 
    at org.jboss.remoting.transport.http.HTTPClientInvoker.makeInvocation(HTTPClientInvoker.java:231) 
    ... 48 more 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:294) 
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:200) 
    at sun.security.validator.Validator.validate(Validator.java:218) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014) 
    ... 62 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) 
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:289) 
    ... 68 more 

我想問一下我能做些什麼來解決它？我是否需要在server.xml中爲此證書添加另一個這樣的文件：

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" 
    scheme="https" secure="false" strategy="ms" address="${jboss.bind.address}" 
    keystoreFile="${jboss.server.home.dir}/conf/.keystore" 
    keystorePass="changeit" sslProtocol="TLS" 
    truststoreFile="/usr/lib/jvm/java-6-sun-1.6.0.10/jre/lib/security/cacerts" 
    truststorePass="*****" 
    SSLImplementation="org.jsslutils.extra.apachetomcat6.JSSLutilsImplementation" 
    acceptAnyCert="true" clientAuth="want" /> 

或者我是否犯了其他錯誤？

Answer 1

如果是客戶端證書，那麼您需要將其放入您的信任庫;如果它是一個服務器證書，那麼它會進入你的密鑰庫。此外，如果您的證書具有中間CA證書，您也需要添加它們。

Answer 2

對於SSL的Web服務配置就必須使這個步驟：

1）插入CA證書導入密鑰庫，你可以把這個JVM或者把這個到JRE安全目錄，也可以導入到JRE默認密鑰庫。

2）將密鑰導入密鑰庫（可能是java密鑰庫或其他密鑰庫）。 keystore也可以是jks，不僅是pkcs12。我已經測試過，jks的工作也很好。

3）告訴JVM您需要該密鑰庫 - 當我們啓動Jboss時。它可以是這樣的（在我的情況下，它看起來像這樣）：

> "-Dprogram.name=JBossTools: JBoss 4.0 CLONE OF ESS SERVER" -server 
> -Xms256m -Xmx512m -XX:MaxPermSize=256m -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000 "-Djava.endorsed.dirs=..\jboss-4.0.2\lib\endorsed" 
> "-Djavax.net.ssl.keyStore=../Java/jdk1.6.0_45/jre/lib/security/cacerts" 
> "-Djavax.net.ssl.keyStorePassword=changeit" 

而且證書可德encodded或基地64這意味着你可能需要證書轉換開放SSL等也是另問題在於有時候轉換可能會導致問題，因此您可以使用這樣的script進行更簡單和靈活的轉換。

Answer 3

我知道你說你已經導入證書，但看看這些步驟，看看你是否錯過了什麼地方了一步：

下面是如何導入證書，以解決以下錯誤整體摘要：

Error while trying to execute request. javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

如何導入證書

1. 轉到ŧ在瀏覽器中Ø網址，點擊HTTPS證書鏈（旁邊的URL地址的小鎖標誌），以導出證書
   • 點擊「詳細信息」 - >「安全」 - >「顯示證書」>「詳細信息」> 「出口..」。
   • 另存爲.der
   • 重複以上步驟，你需要導入
2. 找到$ JAVA_HOME/JRE/lib/security中/ cacerts的

3. 導入所有* .der文件任何證書到cacerts文件使用下列內容：

   sudo keytool -import -alias mysitestaging -keystore $JAVA_HOME/jre/lib/security/cacerts -file staging.der 
   sudo keytool -import -alias mysiteprod -keystore $JAVA_HOME/jre/lib/security/cacerts -file prod.der 
   sudo keytool -import -alias mysitedev -keystore $JAVA_HOME/jre/lib/security/cacerts -file dev.der 
   

4. 的默認密鑰庫密碼是「的changeit」

5. 您可以查看您使用此命令，顯示證書指紋所做的更改。

   keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts 
   

6. 如果這不能解決問題，請嘗試將這些Java選項參數：

   -Djavax.net.ssl.trustStore="$JAVA_HOME/jre/lib/security/cacerts" 
   -Djavax.net.ssl.trustStorePassword="changeit" 
   

Answer 4

我有這個錯誤是由於AVAST防毒。