title: SSLHandshakeException: PKIX path building failed
body: <p>I've been trying to debug this error with no luck.</p>
  
  <p>Essentially I'm contacting an external app throught my app. The connection is established fine, the app contacts back my app through a callback URL, then I need to send a final validation to the external app.
  This last step is failing because of an SSLHandShajeException.</p>
  
  <blockquote>
    <p>javax.net.ssl.SSLHandshakeException:
    sun.security.validator.ValidatorException: PKIX path building failed:
    sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target</p>
  </blockquote>
  
  <p>I've had a look at the possible causes, and created a truststore with the external app cert in it following these steps:</p>
  
  <ul>
  <li>download the cert chain from the browser</li>
  <li>creating the truststore with </li>
  </ul>
  
  <blockquote>
    <p>keytool -import -v -trustcacerts -alias mycert -file
    x_my_cert_location_x -keystore truststore</p>
  </blockquote>
  
  <ul>
  <li>adding the above trustore in my setenv file</li>
  <li>restart my tomcat instance.</li>
  </ul>
  
  <p>This has not resolved the problem.</p>
  
  <p>I also added to cert to the cacert file, and the same to the connector in the server.xml file as follows:</p>
  
  <blockquote>
  <pre><code>&lt;Connector port="${catalina.port.https}" server="Apache" protocol="HTTP/1.1"
             SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLS"
             clientAuth="false"
             connectionTimeout="20000"
             compression="on"
             compressionMinSize="200"
             compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml"
             enableLookups="false"
             URIEncoding="UTF-8"
             keystoreFile="my_store_location" keystorePass="myPwd"/&gt;
  </code></pre>
  </blockquote>
  
  <p>Debugging in the SSL, I can see:</p>
  
  <pre><code>&gt; %% Invalidated: [Session-15, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
  &gt; http-nio-8080-exec-9, SEND TLSv1.2 ALERT: fatal, description =
  &gt; certificate_unknown http-nio-8080-exec-9, WRITE: TLSv1.2 Alert, length
  &gt; = 2 [Raw write]: length = 7 0000: 15 03 03 00 02 02 2E ....... http-nio-8080-exec-9, called closeSocket() http-nio-8080-exec-9,
  &gt; handling exception: javax.net.ssl.SSLHandshakeException:
  &gt; sun.security.validator.ValidatorException: PKIX path building failed:
  &gt; sun.security.provider.certpath.SunCertPathBuilderException: unable to
  &gt; find valid certification path to requested target
  </code></pre>
  
  <p>Which makes no real sense to me. My app is on java 1.8.242. Any advice on this please?</p>