Cómo ignorar la creación de rutas PKIX fallido: sun.security.provider.certpath.SunCertPathBuilderException?

Recibí la siguiente excepción cuando bash publicar una solicitud en un servidor http:

Aquí está el código que utilicé

URL url = new URL( "https://www.abc.com"); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setRequestMethod("GET"); conn.setDoOutput(true); DataOutputStream wr = new DataOutputStream(conn.getOutputStream()); // wr.writeBytes(params); wr.flush(); wr.close(); BufferedReader br = new BufferedReader(new InputStreamReader( conn.getInputStream())); String line = null; while ((line = br.readLine()) != null) { System.out.println(line); } 

Aquí está la excepción:

 Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1014) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230) at com.amazon.mzang.tools.httpchecker.CategoryYank.getPV(CategoryYank.java:32) at com.amazon.mzang.tools.httpchecker.CategoryYank.main(CategoryYank.java:18) Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217) at sun.security.validator.Validator.validate(Validator.java:218) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185) ... 13 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318) ... 19 more 

El servidor no es de mi propiedad. ¿Hay alguna manera de ignorar esta excepción?

Si quiere ignorar el certificado todos juntos, eche un vistazo a la respuesta aquí: Ignore el certificado SSL autofirmado utilizando Jersey Client

Aunque esto hará que su aplicación sea vulnerable a los ataques man-in-the-middle.

O bien, intente agregar el certificado a su tienda java como certificado de confianza. Este sitio puede ser útil. http://blog.icodejava.com/tag/get-public-key-of-ssl-certificate-in-java/

Aquí hay otro hilo que muestra cómo agregar un certificado a su tienda. Java SSL connect, agregue el certificado del servidor al keystore mediante progtwigción

La clave es:

 KeyStore.Entry newEntry = new KeyStore.TrustedCertificateEntry(someCert); ks.setEntry("someAlias", newEntry, null); 

He utilizado el siguiente código para anular la verificación de SSL en mi proyecto y funcionó para mí.

 package com.beingjavaguys.testftp; import java.io.InputStreamReader; import java.io.Reader; import java.net.URL; import java.net.URLConnection; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSession; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; import java.security.cert.X509Certificate; /** * Fix for Exception in thread "main" javax.net.ssl.SSLHandshakeException: * sun.security.validator.ValidatorException: PKIX path building failed: * sun.security.provider.certpath.SunCertPathBuilderException: unable to find * valid certification path to requested target */ public class ConnectToHttpsUrl { public static void main(String[] args) throws Exception { /* Start of Fix */ TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted(X509Certificate[] certs, String authType) { } public void checkServerTrusted(X509Certificate[] certs, String authType) { } } }; SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new java.security.SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); // Create all-trusting host name verifier HostnameVerifier allHostsValid = new HostnameVerifier() { public boolean verify(String hostname, SSLSession session) { return true; } }; // Install the all-trusting host verifier HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid); /* End of the fix*/ URL url = new URL("https://nameofthesecuredurl.com"); URLConnection con = url.openConnection(); Reader reader = new InputStreamReader(con.getInputStream()); while (true) { int ch = reader.read(); if (ch == -1) break; System.out.print((char) ch); } } } 

Establezca la propiedad validateTLSCertificates en false para su comando JSoup .

 Jsoup.connect("https://google.com/").validateTLSCertificates(false).get(); 

FWIW, en Ubuntu 10.04.2 LTS instalando los paquetes ca-certificates-java y ca-certificates solucionó este problema para mí.

Obtuve el mismo error al ejecutar la prueba simple de spring-boot + RestAssured below.

 import org.junit.Test; import org.junit.runner.RunWith; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import static com.jayway.restassured.RestAssured.when; import static org.apache.http.HttpStatus.SC_OK; @RunWith(SpringJUnit4ClassRunner.class) public class GeneratorTest { @Test public void generatorEndPoint() { when().get("https://bal-bla-bla-bla.com/generators") .then().statusCode(SC_OK); } } 

La solución simple en mi caso es agregar ‘useRelaxedHTTPSValidations ()’

 RestAssured.useRelaxedHTTPSValidation(); 

Entonces la prueba se ve como

 import org.junit.Test; import org.junit.runner.RunWith; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import static com.jayway.restassured.RestAssured.when; import static org.apache.http.HttpStatus.SC_OK; @RunWith(SpringJUnit4ClassRunner.class) public class GeneratorTest { @Before public void setUp() { RestAssured.useRelaxedHTTPSValidation(); } @Test public void generatorEndPoint() { when().get("https://bal-bla-bla-bla.com/generators") .then().statusCode(SC_OK); } }