在浏览器中进入URL:

点击HTTPS证书链(URL地址旁边的锁图标)。点击“更多信息”>“安全”>“显示证书“>”详细信息“>”导出。拾取名称并选择文件类型example.cer chrome -点击网站图标左侧地址栏，选择“证书”->“详细信息”->“导出”并保存为“Der-encoded binary, single Certificate”格式。

现在您有了带有密钥存储库的文件，并且必须将其添加到JVM中。确定cacerts文件的位置，例如。 C:\Program Files (x86)\Java\ jre1.6.0_22\lib\security\cacerts。 接下来导入示例。在命令行中将Cer文件转换为cacerts(可能需要管理员命令提示符):

"C:\Program Files (x86)\Java\jre1.6.0_22\lib\security\cacerts" -file example.cer

您将被要求输入密码，默认为changeit

重新启动JVM/PC。

来源: http://magicmonster.com/kb/prg/java/ssl/pkix_path_building_failed.html

问题背景:

当我试图在我的项目中运行mvn清洁安装并通过Netbeans IDE清洁和构建选项时，我得到了以下错误。 此问题是由于通过NET beans IDE/通过命令提示符下载时证书不可用，但可以通过浏览器下载文件。

错误:

Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact com.java.project:product:jar:1.0.32 from/to repo-local (https://url/local-repo): sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  

解决方法:

1. 下载有关网址的证书:

Launch IE by "run as adminstrator" (otherwise, we will not be able to download the certificate) Enter the url in IE-> https://url/local-repo (In my case this url had a untrusted certificate.) Download the certificate by clicking on Certificate error -> view certificate Select Details tab -> copy to file -> next -> select "DER encoded binary X.509 (.CER) save the certificate in some location, example : c:/user/sheldon/desktop/product.cer Congrats! you have successfully downloaded the certificate for the site

2. 现在安装密钥存储库以修复该问题。

运行keytool命令将下载的密钥存储库附加到 已存在的证书文件。 命令:jdk (JAVA_HOME) bin文件夹下的如下命令。

C:\Program Files\Java\ jdk1.8.0_141\jre\bin>keytool -importcert -file .使用实例 “C: / user /谢耳朵/桌面/产品。-alias product -keystore “C: /程序文件/ Java / jdk1.8.0_141 / jre / lib /安全/除”。

系统将提示您输入密码。输入keystore密码: 再次输入“changeit”，输入“信任此证书?”(没有):“,输入 “是的”

示例命令行命令/输出:

keytool -importcert -file "C:/Users/sheldon/Desktop/product.cer" -alias product -keystore "C:/Program iles/Java/jdk1.8.0_141/jre/lib/security/cacerts"
Enter keystore password:
Trust this certificate? [no]:  yes
Certificate was added to keystore

Contgrats !现在你应该删除“PKIX路径构建失败:sun.security.provider.certpath”。在Netbeans IDE中出现SunCertPathBuilderException错误。

这不是twitter特有的答案，但这是在搜索此错误时出现的问题。如果您的系统在连接到一个在web浏览器中查看时似乎具有有效证书的网站时接收到此错误，这可能意味着该网站具有不完整的证书链。

简单总结一下这个问题:证书颁发机构不会使用他们的根证书对任何旧证书进行签名。相反，它们(通常)签署也设置了证书颁发机构标志的中间证书(也就是说，允许签署证书)。然后，当您从CA购买证书时，他们将使用这些中间证书之一签署您的CSR。

您的Java信任存储区很可能只有根证书，而没有中间证书。

错误配置的站点可能只返回已签名的证书。问题:该站点使用的中间证书不在您的信任存储区中。浏览器将通过下载或使用缓存的中间证书来处理这个问题;这最大限度地提高了网站的兼容性。然而，Java和像OpenSSL这样的工具不会。这会导致问题中的错误。

您可以通过使用Qualys SSL测试来验证这种怀疑。如果你在网站上搜索，上面写着

此服务器的证书链不完整。

那就证实了这一点。您还可以通过查看认证路径并查看文本Extra Download来了解这一点。

How to fix it: the server administrator needs to configure the web server to return the intermediate certificates as well. For Comodo, for example, this is where the .ca-bundle file comes in handy. For example, in an Apache configuration with mod_ssl, you'd use the SSLCertificateChainFile configuration setting. For nginx, you need to concatenate the intermediate certificates and the signed certificate and use that in the SSL cert configuration. You can find more by searching for "incomplete certificate chain" online.

目标:

使用HTTPS连接 验证SSL链 不处理仙人掌 在运行时添加证书 不从cacerts丢失证书

怎么做:

定义自己的密钥库 将证书放入密钥库 使用自定义类重新定义SSL默认上下文 ?？? 利润

我的Keystore包装文件:

public class CertificateManager {

    private final static Logger logger = Logger.getLogger(CertificateManager.class);

    private String keyStoreLocation;
    private String keyStorePassword;
    private X509TrustManager myTrustManager;
    private static KeyStore myTrustStore;

    public CertificateManager(String keyStoreLocation, String keyStorePassword) throws Exception {
        this.keyStoreLocation = keyStoreLocation;
        this.keyStorePassword = keyStorePassword;
        myTrustStore = createKeyStore(keyStoreLocation, keyStorePassword);
    }

    public void addCustomCertificate(String certFileName, String certificateAlias)
            throws Exception {
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init((KeyStore) null);
        Certificate certificate = myTrustStore.getCertificate(certificateAlias);
        if (certificate == null) {
            logger.info("Certificate not exists");
            addCertificate(certFileName, certificateAlias);
        } else {
            logger.info("Certificate exists");
        }
        tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(myTrustStore);
        for (TrustManager tm : tmf.getTrustManagers()) {
            if (tm instanceof X509TrustManager) {
                setMytrustManager((X509TrustManager) tm);
                logger.info("Trust manager found");
                break;
            }
        }
    }

    private InputStream fullStream(String fname) throws IOException {
        ClassLoader classLoader = getClass().getClassLoader();
        InputStream resource = classLoader.getResourceAsStream(fname);
        try {
            if (resource != null) {
                DataInputStream dis = new DataInputStream(resource);
                byte[] bytes = new byte[dis.available()];
                dis.readFully(bytes);
                return new ByteArrayInputStream(bytes);
            } else {
                logger.info("resource not found");
            }
        } catch (Exception e) {
            logger.error("exception in certificate fetching as resource", e);
        }
        return null;
    }

    public static KeyStore createKeyStore(String keystore, String pass) throws Exception {
        try {
            InputStream in = CertificateManager.class.getClass().getResourceAsStream(keystore);
            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(in, pass.toCharArray());
            logger.info("Keystore was created from resource file");
            return keyStore;
        } catch (Exception e) {
            logger.info("Fail to create keystore from resource file");
        }

        File file = new File(keystore);
        KeyStore keyStore = KeyStore.getInstance("JKS");
        if (file.exists()) {
            keyStore.load(new FileInputStream(file), pass.toCharArray());
            logger.info("Default keystore loaded");
        } else {
            keyStore.load(null, null);
            keyStore.store(new FileOutputStream(file), pass.toCharArray());
            logger.info("New keystore created");
        }
        return keyStore;
    }

    private void addCertificate(String certFileName, String certificateAlias) throws CertificateException,
            IOException, KeyStoreException, NoSuchAlgorithmException {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        InputStream certStream = fullStream(certFileName);
        Certificate certs = cf.generateCertificate(certStream);
        myTrustStore.setCertificateEntry(certificateAlias, certs);
        FileOutputStream out = new FileOutputStream(getKeyStoreLocation());
        myTrustStore.store(out, getKeyStorePassword().toCharArray());
        out.close();
        logger.info("Certificate pushed");
    }

    public String getKeyStoreLocation() {
        return keyStoreLocation;
    }

    public String getKeyStorePassword() {
        return keyStorePassword;
    }
    public X509TrustManager getMytrustManager() {
        return myTrustManager;
    }
    public void setMytrustManager(X509TrustManager myTrustManager) {
        this.myTrustManager = myTrustManager;
    }
}

如果需要，该类将创建密钥存储库，并能够在其中管理证书。下面是SSL context的类:

public class CustomTrustManager implements X509TrustManager {

    private final static Logger logger = Logger.getLogger(CertificateManager.class);

    private static SSLSocketFactory socketFactory;
    private static CustomTrustManager instance = new CustomTrustManager();
    private static List<CertificateManager> register = new ArrayList<>();

    public static CustomTrustManager getInstance() {
        return instance;
    }

    private X509TrustManager defaultTm;

    public void register(CertificateManager certificateManager) {
        for(CertificateManager manager : register) {
            if(manager == certificateManager) {
                logger.info("Certificate manager already registered");
                return;
            }
        }
        register.add(certificateManager);
        logger.info("New Certificate manager registered");
    }

    private CustomTrustManager() {
        try {
            String algorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);

            tmf.init((KeyStore) null);
            boolean found = false;
            for (TrustManager tm : tmf.getTrustManagers()) {
                if (tm instanceof X509TrustManager) {
                    defaultTm = (X509TrustManager) tm;
                    found = true;
                    break;
                }
            }
            if(found) {
                logger.info("Default trust manager found");
            } else {
                logger.warn("Default trust manager was not found");
            }

            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, new TrustManager[]{this}, null);
            SSLContext.setDefault(sslContext);
            socketFactory = sslContext.getSocketFactory();
            HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);


            logger.info("Custom trust manager was set");
        } catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
            logger.warn("Custom trust manager can't be set");
            e.printStackTrace();
        }
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        List<X509Certificate> out = new ArrayList<>();
        if (defaultTm != null) {
            out.addAll(Arrays.asList(defaultTm.getAcceptedIssuers()));
        }
        int defaultCount = out.size();
        logger.info("Default trust manager contain " + defaultCount + " certficates");
        for(CertificateManager manager : register) {
            X509TrustManager customTrustManager = manager.getMytrustManager();
            X509Certificate[] issuers = customTrustManager.getAcceptedIssuers();
            out.addAll(Arrays.asList(issuers));
        }
        logger.info("Custom trust managers contain " + (out.size() - defaultCount) + " certficates");
        X509Certificate[] arrayOut = new X509Certificate[out.size()];
        return out.toArray(arrayOut);
    }

    @Override
    public void checkServerTrusted(X509Certificate[] chain,
                                   String authType) throws CertificateException {
        for(CertificateManager certificateManager : register) {
            X509TrustManager customTrustManager = certificateManager.getMytrustManager();
            try {
                customTrustManager.checkServerTrusted(chain, authType);
                logger.info("Certificate chain (server) was aproved by custom trust manager");
                return;
            } catch (Exception e) {
            }
        }
        if (defaultTm != null) {
            defaultTm.checkServerTrusted(chain, authType);
            logger.info("Certificate chain (server) was aproved by default trust manager");
        } else {
            logger.info("Certificate chain (server) was rejected");
            throw new CertificateException("Can't check server trusted certificate.");
        }
    }

    @Override
    public void checkClientTrusted(X509Certificate[] chain,
                                   String authType) throws CertificateException {
        try {
            if (defaultTm != null) {
                defaultTm.checkClientTrusted(chain, authType);
                logger.info("Certificate chain (client) was aproved by default trust manager");
            } else {
                throw new NullPointerException();
            }
        } catch (Exception e) {
            for(CertificateManager certificateManager : register) {
                X509TrustManager customTrustManager = certificateManager.getMytrustManager();
                try {
                    customTrustManager.checkClientTrusted(chain, authType);
                    logger.info("Certificate chain (client) was aproved by custom trust manager");
                    return;
                } catch (Exception e1) {
                }
            }
            logger.info("Certificate chain (client) was rejected");
            throw new CertificateException("Can't check client trusted certificate.");
        }
    }

    public SSLSocketFactory getSocketFactory() {
        return socketFactory;
    }
}

这个类被设置为单例，因为只允许一个defaultSSL上下文。现在来看用法:

            CertificateManager certificateManager = new CertificateManager("C:\\myapplication\\mykeystore.jks", "changeit");
            String certificatePath = "C:\\myapplication\\public_key_for_your_ssl_service.crt";
            try {
                certificateManager.addCustomCertificate(certificatePath, "alias_for_public_key_for_your_ssl_service");
            } catch (Exception e) {
                log.error("Can't add custom certificate");
                e.printStackTrace();
            }
            CustomTrustManager.getInstance().register(certificateManager);

可能，它将无法与此设置，因为我将证书文件保存在资源文件夹内，所以我的路径不是绝对的。但总的来说，它工作得很完美。

经过半天的努力，又找到了一个解决问题的方法。我能够在MAC 10.15.5 (Catalina)中解决这个问题。遵循以下步骤。

This problem occurs when we are running behind a company proxy , In my case its Zscaler. Open Key chain access, export CA certificate.(Select CA certificate, File->export items and save with the desired name) Copy the path of existing cacerts from java folder(/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts ) Open terminal and navigate to the Keytool folder (/Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/bin ) Run the below command. Keytool -importcert - file (Path to exported cert from the keychainaccess) -alias (give a name) -keystore (Path of existing cacerts from java folder) sudo Keytool -importcert -file /Users/Desktop/RootCA.cer -alias demo -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_251.jdk/Contents/Home/jre/lib/security/cacerts It will ask for password , give it as : changeit It asks for confirmation , Say : yes

完成所有这些步骤后，退出eclipse并启动新的会话。

问题是，您的eclipse无法连接实际上它正在尝试连接的站点。 我也遇到过类似的问题，下面给出的解决方案对我来说很有效。

关闭任何第三方互联网安全应用程序，如Zscaler 有时也需要断开VPN如果你是连接的。

谢谢