“PKIX路径构建失败”和“无法找到请求目标的有效认证路径”

我试图使用twitter4j库为我的java项目获得推文，它在封面下使用java.net.HttpURLConnection(可以在堆栈跟踪中看到)。在我第一次运行时，我得到了一个关于证书sun.security.validator.ValidatorException和sun.security.provider.certpath.SunCertPathBuilderException的错误。然后我添加了twitter证书:

C:\Program Files\Java\jdk1.7.0_45\jre\lib\security>keytool -importcert -trustcacerts -file PathToCert -alias ca_alias -keystore "C:\Program Files\Java\jdk1.7.0_45\jre\lib\security\cacerts"

但是没有成功。以下是获取推文的流程:

public static void main(String[] args) throws TwitterException {
    ConfigurationBuilder cb = new ConfigurationBuilder();
    cb.setDebugEnabled(true)
        .setOAuthConsumerKey("myConsumerKey")
        .setOAuthConsumerSecret("myConsumerSecret")
        .setOAuthAccessToken("myAccessToken")
        .setOAuthAccessTokenSecret("myAccessTokenSecret");
    
    TwitterFactory tf = new TwitterFactory(cb.build());
    Twitter twitter = tf.getInstance();
    
    try {
        Query query = new Query("iphone");
        QueryResult result;
        result = twitter.search(query);
        System.out.println("Total amount of tweets: " + result.getTweets().size());
        List<Status> tweets = result.getTweets();
        
        for (Status tweet : tweets) {
            System.out.println("@" + tweet.getUser().getScreenName() + " : " + tweet.getText());
        }
    } catch (TwitterException te) {
        te.printStackTrace();
        System.out.println("Failed to search tweets: " + te.getMessage());
    }

这里是错误:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Relevant discussions can be found on the Internet at:
    http://www.google.co.jp/search?q=d35baff5 or
    http://www.google.co.jp/search?q=1446302e
TwitterException{exceptionCode=[d35baff5-1446302e 43208640-747fd158 43208640-747fd158 43208640-747fd158], statusCode=-1, message=null, code=-1, retryAfter=-1, rateLimitStatus=null, version=3.0.5}
    at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:177)
    at twitter4j.internal.http.HttpClientWrapper.request(HttpClientWrapper.java:61)
    at twitter4j.internal.http.HttpClientWrapper.get(HttpClientWrapper.java:81)
    at twitter4j.TwitterImpl.get(TwitterImpl.java:1929)
    at twitter4j.TwitterImpl.search(TwitterImpl.java:306)
    at jku.cc.servlets.TweetsAnalyzer.main(TweetsAnalyzer.java:38)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
    at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    at sun.security.ssl.Handshaker.process_record(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at java.net.HttpURLConnection.getResponseCode(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
    at twitter4j.internal.http.HttpResponseImpl.<init>(HttpResponseImpl.java:34)
    at twitter4j.internal.http.HttpClientImpl.request(HttpClientImpl.java:141)
    ... 5 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
    at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
    at sun.security.validator.Validator.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
    ... 20 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
    at java.security.cert.CertPathBuilder.build(Unknown Source)
    ... 26 more
Failed to search tweets: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

当前回答

它是对答案https://stackoverflow.com/a/36427118/1491414的补充。由于@MagGGG

请确保您有管理员权限请使用双引号作为密钥存储库路径(-keystore C:\Program Files (x86)\Java\ jre1.6.0_22\lib\security\cacerts")，因为在Windows操作系统中，默认的安装位置将是程序文件，由于程序文件之间的空格，您将得到一个错误。

2017-12-23 20:32:12

其他回答

我的UI方法:

从这里下载密钥库资源管理器打开$ JAVA_HOME / jre / lib /安全/除输入PW: changeit(可以在Mac上changeme) 导入.crt文件

CMD-Line:

Keytool -importcert -file jetty。crt -alias jetty -keystore $JAVA_HOME/jre/lib/security/cacerts . crt -alias jetty -keystore $JAVA_HOME/jre/lib/security/cacerts . crt 输入PW: changeit(可以在Mac上changeme)

2016-11-22 14:06:23

在这里，这种异常通常发生在受信任证书的PATH不匹配时。检查用于安全通信的服务器证书所需的配置或路径。

2014-01-12 19:32:53

这是针对Glassfish服务器的:

通常Glassfish会看着仙人掌。证书文件存放在GLASSFISH_SERVER\glassfish\domains\domain1\config目录下。您可以更改此配置或替换cacerts。JKS文件和cacerts文件。

Glassfish使用了一些默认的JVM选项:

 -XX:+UnlockDiagnosticVMOptions
 -XX:NewRatio=2
 -XX:MaxPermSize=192m
 -Xmx512m
 -client
 -javaagent:C:/glassfish5/glassfish/lib/monitor/flashlight-agent.jar
 -Djavax.xml.accessExternalSchema=all
 -Djavax.net.ssl.trustStore=C:\glassfish5\glassfish\domains\domain1/config/cacerts.jks
 -Djdk.tls.rejectClientInitiatedRenegotiation=true
 -Djdk.corba.allowOutputStreamSubclass=true

2022-06-22 13:50:06

我的情况略有不同，当时我的系统上同时存在JDK和JRE 1.8.0_112。

我导入新的CA证书到[JDK_FOLDER]\jre\lib\security\cacerts使用已知的命令:

keytool -import -trustcacerts -keystore cacerts -alias <new_ca_alias> -file <path_to_ca_cert_file>

尽管如此，我仍然得到相同的PKIX路径构建失败错误。

我在java命令行中添加了调试信息，使用java -Djavax.net.debug=all…> debug.log。在debug.log文件中，以trustStore开头的行实际上指向[JRE_FOLDER]\lib\security\cacerts中找到的cacerts存储。

在我的案例中，解决方案是将JDK使用的cacerts文件(添加了新的ca)复制到JRE使用的cacerts文件上，这样就解决了问题。

2016-12-21 09:19:13

这不是twitter特有的答案，但这是在搜索此错误时出现的问题。如果您的系统在连接到一个在web浏览器中查看时似乎具有有效证书的网站时接收到此错误，这可能意味着该网站具有不完整的证书链。

简单总结一下这个问题:证书颁发机构不会使用他们的根证书对任何旧证书进行签名。相反，它们(通常)签署也设置了证书颁发机构标志的中间证书(也就是说，允许签署证书)。然后，当您从CA购买证书时，他们将使用这些中间证书之一签署您的CSR。

您的Java信任存储区很可能只有根证书，而没有中间证书。

错误配置的站点可能只返回已签名的证书。问题:该站点使用的中间证书不在您的信任存储区中。浏览器将通过下载或使用缓存的中间证书来处理这个问题;这最大限度地提高了网站的兼容性。然而，Java和像OpenSSL这样的工具不会。这会导致问题中的错误。

您可以通过使用Qualys SSL测试来验证这种怀疑。如果你在网站上搜索，上面写着

此服务器的证书链不完整。

那就证实了这一点。您还可以通过查看认证路径并查看文本Extra Download来了解这一点。

How to fix it: the server administrator needs to configure the web server to return the intermediate certificates as well. For Comodo, for example, this is where the .ca-bundle file comes in handy. For example, in an Apache configuration with mod_ssl, you'd use the SSLCertificateChainFile configuration setting. For nginx, you need to concatenate the intermediate certificates and the signed certificate and use that in the SSL cert configuration. You can find more by searching for "incomplete certificate chain" online.

2017-11-30 00:13:45

“PKIX路径构建失败”和“无法找到请求目标的有效认证路径”

推荐文章

最新文章

标签