title: How to add HTTPS certifications for Java application inside docker?
body: <p>I have a java application that make a POST request to an HTTP API protected with certificates. When I ran it locally the first time I got the following exception:</p>
  
  <pre><code>I/O error on POST request for "https://...
  sun.security.validator.ValidatorException: PKIX path building failed:
  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException:
  sun.security.validator.ValidatorException: PKIX path building failed: 
  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>To fix it I exported the certificate from Firefox and did the following:</p>
  
  <pre><code>sudo keytool -import -alias example -keystore  /usr/lib/jvm/java-8-oracle/jre/lib/security/cacerts -file /path/to/certificate.der
  </code></pre>
  
  <p>Reboot and then it worked.</p>
  
  <p>Now I want the application to run on Docker. So, as I have done before, I use docker-maven-plugin from Spotify with <a href="https://hub.docker.com/_/openjdk/" rel="noreferrer">openjdk</a> as base image. The first error appears again, so I try to fix it the same way. </p>
  
  <p>Plugin usage:</p>
  
  <pre><code>&lt;plugin&gt;
  &lt;groupId&gt;com.spotify&lt;/groupId&gt;
  &lt;artifactId&gt;docker-maven-plugin&lt;/artifactId&gt;
  &lt;version&gt;0.4.13&lt;/version&gt;
  &lt;configuration&gt;
      &lt;useConfigFile&gt;true&lt;/useConfigFile&gt;
      &lt;imageName&gt;${project.artifactId}:${project.version}&lt;/imageName&gt;
      &lt;baseImage&gt;openjdk:latest&lt;/baseImage&gt;
      &lt;imageTags&gt;
          &lt;imageTag&gt;latest&lt;/imageTag&gt;
          &lt;imageTag&gt;${project.version}&lt;/imageTag&gt;
      &lt;/imageTags&gt;
      &lt;resources&gt;
          &lt;resource&gt;
              &lt;targetPath&gt;/path/${project.artifactId}&lt;/targetPath&gt;
              &lt;directory&gt;${project.build.directory}&lt;/directory&gt;
              &lt;include&gt;${project.build.finalName}-jar-with-dependencies.jar&lt;/include&gt;
          &lt;/resource&gt;
          &lt;resource&gt;
              &lt;targetPath&gt;/path/${project.artifactId}&lt;/targetPath&gt;
              &lt;directory&gt;${project.basedir}&lt;/directory&gt;
              &lt;include&gt;certificate.der&lt;/include&gt;
          &lt;/resource&gt;
      &lt;/resources&gt;
      &lt;runs&gt;
          &lt;run&gt;$JAVA_HOME/bin/keytool -import -noprompt -trustcacerts -alias example -file /path/certificate.der -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit&lt;/run&gt;
          &lt;run&gt;chmod 555 /path&lt;/run&gt;
          &lt;run&gt;chmod 444 /path/${project.build.finalName}-jar-with-dependencies.jar&lt;/run&gt;
      &lt;/runs&gt;
      &lt;entryPoint&gt;
          ["java", "-jar", "/path/${project.build.finalName}-jar-with-dependencies.jar"]
      &lt;/entryPoint&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p></p>
  
  <p>The Dockerfile generated is:</p>
  
  <pre><code>FROM openjdk:latest
  ADD /path/application.jar /path/
  ADD /path/certificate.der /path/
  RUN $JAVA_HOME/bin/keytool -import -noprompt -trustcacerts -alias example -file /path/certificate.der -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
  RUN chmod 555 /path
  RUN chmod 444 /path/application.jar
  ENTRYPOINT ["java", "-jar", "/path/application.jar"]
  </code></pre>
  
  <p>The problem is not fixed. I run docker and when post request is done I have exactly the same error as if I don't have the certificate in the keystore, the one I mentioned at the beginning. Also, if I check the keystore it has the certificate.</p>
  
  <p>What am I missing? </p>
  
  <p>Any help is appreciated :)</p>