1

Trying to enable HTTPS microservices. Able to access the discovery URL with HTTPS but when trying to run the java -jar discovery-registration.jar read. We are getting the following error

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

We verified the certificates are added to JavaKeyStore and able to view the certificate which includes the root certificate and intermediate certificate.

Let me know if anyone faced a similar issue.

Improve this question

2 Answers 2

Reset to default
2

AFAIK - This error most likely still your certificate is not correctly exported and imported to configured your SSL Keystore file in microservice.

Try this below PowerShell script to export the CA certificate and generate the Keystore file using the key tool.

$thumbprintNumber="2F4463A65623BAA4E5CE83EB0B91F800B0CEF327"
$certficateFilePath = "D:\Apps\certs\certificate.pfx"
$password="xxxxx"

Write-Host "Exporting the Certificates..." -ForegroundColor Green
Export-PfxCertificate -Cert (Get-Item -Path Cert:\LocalMachine\My\$thumbprintNumber) -FilePath $certficateFilePath -ChainOption BuildChain -NoProperties -Password (ConvertTo-SecureString -String $password -Force -AsPlainText)

$keystoreAliasName = ""
$keystoreFilePath = "D:\Apps\certs\keystore.jks"
$JAVAHomeBinPATH ="C:\Program Files\Java\jdk1.8.0_201\bin\keytool.exe"
$keystorepassword = "xxxx"

& "$JAVAHomeBinPATH" -importkeystore -deststorepass $keystorepassword -destkeypass $keystorepassword -destkeystore $keystoreFilePath -deststoretype "PKCS12" -srckeystore $certficateFilePath -srcstoretype "PKCS12" -srcstorepass $keystorepassword

$keystoreAlias = & "$JAVAHomeBinPATH" -v -list -storetype pkcs12 -keystore $keystoreFilePath -storepass $keystorepassword | findstr "Alias" | Out-String
$keystoreAliasValue = ($keystoreAlias -replace 'Alias name: ','alias=') | Out-String | ConvertFrom-StringData
$keystoreAliasName = $keystoreAliasValue.alias


Write-Host "Update this below configuration in the application.properties" -ForegroundColor Green
Write-Host "server.ssl.enabled=true" -ForegroundColor Yellow
Write-Host "server.ssl.protocol=TLS" -ForegroundColor Yellow
Write-Host "server.ssl.key-alias=$keystoreAliasName" -ForegroundColor Yellow
Write-Host "server.ssl.key-store=$keystoreFilePath" -ForegroundColor Yellow
Write-Host "server.ssl.key-store-password=$keystorepassword" -ForegroundColor Yellow

In case if you already have certificate.pfx then modify the script to comment to skip the Export-PfxCertificate.

I hope it helps

Improve this answer
2
  • 2
    after investigating we found that the Java_Home was set to JRE and the path was set to JDK bin . We created a new system variable JDK_HOME and we tried the issue is fixed . Since we had set the JDK bin on the path the service was trying to look for the cert under JDK cacerts
    – user2952
    Commented Feb 24, 2021 at 10:19
  • You should set this as an answer. I've seen this same mistake a few times.
    – Dylan .. Mark Saunders
    Commented Feb 24, 2021 at 13:23
2

after investigating we found that the Java_Home was set to JRE and the path was set to JDK bin . We created a new system variable JDK_HOME and we tried the issue is fixed . Since we had set the JDK bin on the path the service was trying to look for the cert under JDK cacerts

Improve this answer
1
  • Ah yes - there are many variations on the "wrong certificate store" problem. It might seem like a trivial solution, but it will help others, so please also accept this answer.
    – Dominic Cronin
    Commented Feb 25, 2021 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.