PKIX पथ निर्माण को अनदेखा कैसे करें विफल: sun.security.provider.certpath.SunCertPathBuilderException?

Question

मैं जब कोशिश एक http सर्वर को एक अनुरोध पोस्ट करने के लिए निम्न अपवाद है:

Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731) 
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241) 
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136) 
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) 
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197) 
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181) 
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) 
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) 
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1014) 
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230) 
    at com.amazon.mzang.tools.httpchecker.CategoryYank.getPV(CategoryYank.java:32) 
    at com.amazon.mzang.tools.httpchecker.CategoryYank.main(CategoryYank.java:18) 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323) 
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217) 
    at sun.security.validator.Validator.validate(Validator.java:218) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209) 
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249) 
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185) 
    ... 13 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) 
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318) 
    ... 19 more 

सर्वर है:

यहाँ कोड मैं

URL url = new URL(
     "https://www.abc.com"); 
HttpURLConnection conn = (HttpURLConnection) url.openConnection(); 

conn.setRequestMethod("GET"); 

conn.setDoOutput(true); 

DataOutputStream wr = new DataOutputStream(conn.getOutputStream()); 
// wr.writeBytes(params); 
wr.flush(); 
wr.close(); 

BufferedReader br = new BufferedReader(new InputStreamReader(
     conn.getInputStream())); 
String line = null; 
while ((line = br.readLine()) != null) { 
    System.out.println(line); 
} 

यहाँ इस्तेमाल किया अपवाद है मेरे स्वामित्व में नहीं क्या इस अपवाद को अनदेखा करने का कोई तरीका है?

Answer 1

आप सभी को एक साथ तो प्रमाण पत्र पर ध्यान न दें जवाब यहाँ पर एक नज़र लेने के लिए चाहते हैं: Ignore self-signed ssl cert using Jersey Client

हालांकि यह अपने अनुप्रयोग मैन-इन-द-मिडल हमलों की चपेट में कर देगा।

या, अपने जावा स्टोर में प्रमाण विश्वसनीय प्रमाण के रूप में प्रमाणपत्र जोड़ने का प्रयास करें। यह साइट सहायक हो सकती है। http://blog.icodejava.com/tag/get-public-key-of-ssl-certificate-in-java/

यहां एक और धागा दिखा रहा है कि आपके स्टोर में प्रमाणपत्र कैसे जोड़ना है। Java SSL connect, add server cert to keystore programmatically

कुंजी है:

KeyStore.Entry newEntry = new KeyStore.TrustedCertificateEntry(someCert); 
ks.setEntry("someAlias", newEntry, null); 

Answer 2

मैं SSL अपने प्रोजेक्ट में जाँच ओवरराइड करने के लिए नीचे दिए गए कोड का इस्तेमाल किया है और यह मेरे लिए काम किया।

package com.beingjavaguys.testftp; 

import java.io.InputStreamReader; 
import java.io.Reader; 
import java.net.URL; 
import java.net.URLConnection; 

import javax.net.ssl.HostnameVerifier; 
import javax.net.ssl.HttpsURLConnection; 
import javax.net.ssl.SSLContext; 
import javax.net.ssl.SSLSession; 
import javax.net.ssl.TrustManager; 
import javax.net.ssl.X509TrustManager; 
import java.security.cert.X509Certificate; 

/** 
* Fix for Exception in thread "main" javax.net.ssl.SSLHandshakeException: 
* sun.security.validator.ValidatorException: PKIX path building failed: 
* sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
* valid certification path to requested target 
*/ 
public class ConnectToHttpsUrl { 
    public static void main(String[] args) throws Exception { 
     /* Start of Fix */ 
     TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { 
      public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } 
      public void checkClientTrusted(X509Certificate[] certs, String authType) { } 
      public void checkServerTrusted(X509Certificate[] certs, String authType) { } 

     } }; 

     SSLContext sc = SSLContext.getInstance("SSL"); 
     sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
     HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); 

     // Create all-trusting host name verifier 
     HostnameVerifier allHostsValid = new HostnameVerifier() { 
      public boolean verify(String hostname, SSLSession session) { return true; } 
     }; 
     // Install the all-trusting host verifier 
     HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid); 
     /* End of the fix*/ 

     URL url = new URL("https://nameofthesecuredurl.com"); 
     URLConnection con = url.openConnection(); 
     Reader reader = new InputStreamReader(con.getInputStream()); 
     while (true) { 
      int ch = reader.read(); 
      if (ch == -1) 
       break; 
      System.out.print((char) ch); 
     } 
    } 
} 

Answer 3

सेट अपने JSoup आदेश के लिए false को validateTLSCertificates संपत्ति।

Jsoup.connect("https://google.com/").validateTLSCertificates(false).get(); 

Answer 4

Fwiw, Ubuntu 10.04.2 LTS पर ca-प्रमाण पत्र-जावा और ca-प्रमाण पत्र संकुल मेरे लिए यह समस्या ठीक से स्थापित।

Answer 5

मुझे नीचे वसंत-बूट + RestAssured सरल परीक्षण निष्पादित करते समय एक ही त्रुटि मिली।

import org.junit.Test; 
import org.junit.runner.RunWith; 
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; 

import static com.jayway.restassured.RestAssured.when; 
import static org.apache.http.HttpStatus.SC_OK; 

@RunWith(SpringJUnit4ClassRunner.class) 
public class GeneratorTest { 

@Test 
public void generatorEndPoint() { 
    when().get("https://bal-bla-bla-bla.com/generators") 
      .then().statusCode(SC_OK); 
    } 
} 

मेरे मामले में उन्हें आसानी से ठीक 'useRelaxedHTTPSValidations()'

RestAssured.useRelaxedHTTPSValidation(); 

फिर परीक्षण

import org.junit.Test; 
import org.junit.runner.RunWith; 
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; 

import static com.jayway.restassured.RestAssured.when; 
import static org.apache.http.HttpStatus.SC_OK; 

@RunWith(SpringJUnit4ClassRunner.class) 
public class GeneratorTest { 

@Before 
public void setUp() { 
    RestAssured.useRelaxedHTTPSValidation(); 
} 


@Test 
public void generatorEndPoint() { 
    when().get("https://bal-bla-bla-bla.com/generators") 
      .then().statusCode(SC_OK); 
    } 
}