环境中一个java微服务功能异常,看日志报错:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
原因:客户使用的自签名证书,不受jdk的信任。
将客户域名SSL证书导入jdk库:
# export LANG="en_US.UTF-8"
# openssl s_client -connect www.example.com:443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > www.example.com.crt
# keytool -import -file www.example.com.crt -alias www.example.com -keystore $JAVA_HOME/jre/lib/security/cacerts --storepass "changeit" --noprompt -trustcacerts
重启相关java应用,解决。