我在试图从我的应用程序访问https url时遇到了这个错误，该应用程序正在使用自签名证书。 他们提供的是一个.cert文件，我不知道该把它放在哪里。我是这样解决的:

keytool的位置在JDK/bin文件夹下

方法1:将证书添加到默认的Java信任库- cacerts:

keytool -import -alias myCert -file C://certificate.cert -keystore C://Program Files//Java//jdk1.8.0_271//jre//lib//security//cacerts

密码:changeit

方法2:

创建信任存储:

keytool -import -alias myCert -file C://certificate.cert -keystore myTrustStore

它会给你以下提示，可以填充为:

Enter keystore password:changeit
Re-enter new password:changeit
Trust this certificate?yes

这将在运行此命令的文件夹中创建一个myTrustStore文件。 将这个“mytrustStore”复制到一个方便的位置。

使用信任存储:

当你运行你的应用程序/服务器时，传递这些JVM参数:

-Djavax.net.ssl.trustStore=C://myTrustStore -Djavax.net.ssl.trustStorePassword=changeit

在这个问题上浪费了很多时间。如果您导入了证书，您可以看到这里列出了它。

keytool -list -v -keystore $JAVA_HOME/lib/security/cacerts

然后创建新的文件，使用以下命令替换SITE_NAME、SITE_PORT、CERTIFICATE_NAME和保存文件的路径。

echo -n | openssl s_client -connect SITE_NAME:SITE_PORT  \
| openssl x509 > /path/to/save/CERTIFICATE_NAME.cert

就我而言，我在Spring中使用Keycloak时遇到了问题。在我用这个命令创建证书并导入到密钥存储库之后，问题就解决了，它可以正常工作

您需要配置JSSE系统属性，特别是指向客户端证书存储。

通过命令行:

java -Djavax.net.ssl.trustStore=truststores/client.ts com.progress.Client

或者通过Java代码:

import java.util.Properties;
    ...
    Properties systemProps = System.getProperties();
    systemProps.put("javax.net.ssl.keyStorePassword","passwordForKeystore");
    systemProps.put("javax.net.ssl.keyStore","pathToKeystore.ks");
    systemProps.put("javax.net.ssl.trustStore", "pathToTruststore.ts");
    systemProps.put("javax.net.ssl.trustStorePassword","passwordForTrustStore");
    System.setProperties(systemProps);
    ...

更多详情请参阅RedHat网站。

检查$JAVA_HOME/lib/security/cacerts文件是否存在! 在我的情况下，它不是一个文件，而是一个到/etc/ssl/certs/java/cacerts的链接，而且这是一个到自身的链接(什么??)，因此JVM无法找到该文件。

解决方案: 复制真正的cacerts文件(你可以从另一个JDK)到/etc/ssl/certs/java/目录，它将解决你的问题:)

I had the same problem with sbt. It tried to fetch dependencies from repo1.maven.org over ssl but said it was "unable to find valid certification path to requested target url". so I followed this post and still failed to verify a connection. So I read about it and found that the root cert is not enough, as was suggested by the post,so - the thing that worked for me was importing the intermediate CA certificates into the keystore. I actually added all the certificates in the chain and it worked like a charm.

I am working on a tutorial for REST web services at www.udemy.com (REST Java Web Services). The example in the tutorial said that in order to have SSL, we must have a folder called "trust_store" in my eclipse "client" project that should contain a "key store" file (we had a "client" project to call the service, and "service" project that contained the REST web service - 2 projects in the same eclipse workspace, one the client, the other the service). To keep things simple, they said to copy "keystore.jks" from the glassfish app server (glassfish\domains\domain1\config\keystore.jks) we are using and put it into this "trust_store" folder that they had me make in the client project. That seems to make sense: the self-signed certs in the server's key_store would correspond to the certs in the client trust_store. Now, doing this, I was getting the error that the original post mentions. I have googled this and read that the error is due to the "keystore.jks" file on the client not containing a trusted/signed certificate, that the certificate it finds is self-signed.

为了让事情更清楚，让我说一下我理解的“密钥库”。“Jks”包含自签名的certs，以及“cacerts. Jks”。“jks”文件中包含CA证书(由CA签名)。“密钥存储库。Jks是“密钥存储库”，cacerts是“cacerts”。Jks”是“信任商店”。正如一位名叫“布鲁诺”的评论者所说，“密钥库。Jks是本地的，cacerts是本地的。Jks”用于远程客户端。

So, I said to myself, hey, glassfish also has the "cacerts.jks" file, which is glassfish's trust_store file. cacerts.jsk is supposed to contain CA certificates. And apparently I need my trust_store folder to contain a key store file that has at least one CA certificate. So, I tried putting the "cacerts.jks" file in the "trust_store" folder I had made, on my client project, and changing the VM properties to point to "cacerts.jks" instead of "keystore.jks". That got rid of the error. I guess all it needed was a CA cert to work.

这对于生产来说可能并不理想，甚至对于开发来说也不理想。例如，您可以使用“keytool”命令将CA证书添加到“密钥存储库”中。Jks”文件在客户端。但无论如何，希望这至少能缩小可能导致错误的情况。

另外:我的方法似乎对客户端有用(服务器证书添加到客户端trust_store)，看起来上面解决原始帖子的注释对服务器有用(客户端证书添加到服务器trust_store)。欢呼。

Eclipse项目设置:

MyClientProject src 测验 JRE系统库 .．. trust_store ——cacerts.jks ——keystore.jks

MyClientProject.java文件片段:

static {
  // Setup the trustStore location and password
  System.setProperty("javax.net.ssl.trustStore","trust_store/cacerts.jks");
  // comment out below line
  System.setProperty("javax.net.ssl.trustStore","trust_store/keystore.jks");
  System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
  //System.setProperty("javax.net.debug", "all");

  // for localhost testing only
  javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new javax.net.ssl.HostnameVerifier() {
        public boolean verify(String hostname, javax.net.ssl.SSLSession sslSession) {
          return hostname.equals("localhost");
        }

  });
}