title: SSL handshake failure for liberty application using cloudant
body: <p>I've been stuck on this far longer than I want to admit. I want to connect to cloudant/couchdb using WebSphere Liberty.</p>
  
  <p>I'm fairly new to Java app development, Liberty, Cloudant and Bluemix.</p>
  
  <p>I believe I need to add a SSL certificate for cloudant in a local trust store but the only way to do it seems to be by using the Websphere Application Server Integrated Solutions Console, which I can't run using Liberty?</p>
  
  <p>If anyone can guide me in the right direction I would appreciate it alot!</p>
  
  <pre><code>    [ERROR   ] CWPKI0022E: SSL HANDSHAKE FAILURE:  A signer with SubjectDN CN=*.cloudant.com, OU=Engineering, O="Cloudant, Inc.", L=Boston, ST=Massachusetts, C=US was sent from the target host.  The signer might need to be added to local trust store C:/Users/user/Liberty/usr/servers/simplespring2/resources/security/key.jks, located in SSL configuration alias defaultSSLConfig.  The extended error message from the SSL handshake exception is: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  [ERROR   ] Failed to read cookie response header
  java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  [ERROR   ] CWPKI0022E: SSL HANDSHAKE FAILURE:  A signer with SubjectDN CN=*.cloudant.com, OU=Engineering, O="Cloudant, Inc.", L=Boston, ST=Massachusetts, C=US was sent from the target host.  The signer might need to be added to local trust store C:/Users/user/Liberty/usr/servers/simplespring2/resources/security/key.jks, located in SSL configuration alias defaultSSLConfig.  The extended error message from the SSL handshake exception is: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  [ERROR   ] Failed to get response code from request
  java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  [ERROR   ] SRVE0777E: Exception thrown by application class 'db.CloudantClientMgr.getDB:128'
  java.lang.RuntimeException: DB Not found
      at db.CloudantClientMgr.getDB(CloudantClientMgr.java:128)
      at servlets.LocationServlet.setLocation(LocationServlet.java:180)
      at servlets.LocationServlet.doPost(LocationServlet.java:170)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
      at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1287)
      at [internal classes]
  Caused by: com.cloudant.client.org.lightcouch.CouchDbException: Error retrieving server response
      at com.cloudant.client.org.lightcouch.CouchDbClient.execute(CouchDbClient.java:535)
      at com.cloudant.client.org.lightcouch.CouchDbClient.executeToInputStream(CouchDbClient.java:550)
      at com.cloudant.client.org.lightcouch.CouchDbClient.put(CouchDbClient.java:361)
      at com.cloudant.client.org.lightcouch.CouchDbClient.put(CouchDbClient.java:351)
      at com.cloudant.client.org.lightcouch.CouchDatabaseBase.create(CouchDatabaseBase.java:437)
      at com.cloudant.client.org.lightcouch.CouchDatabaseBase.&lt;init&gt;(CouchDatabaseBase.java:61)
      at com.cloudant.client.org.lightcouch.CouchDatabase.&lt;init&gt;(CouchDatabase.java:26)
      at com.cloudant.client.org.lightcouch.CouchDbClient.database(CouchDbClient.java:165)
      at com.cloudant.client.api.CloudantClient.database(CloudantClient.java:216)
      at db.CloudantClientMgr.getDB(CloudantClientMgr.java:126)
      ... 6 more
  Caused by (repeated) ... : javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
      at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
      at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
      at java.lang.reflect.Constructor.newInstance(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
      at java.security.AccessController.doPrivileged(Native Method)
      at sun.net.www.protocol.http.HttpURLConnection.getChainedException(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
      at java.net.HttpURLConnection.getResponseCode(Unknown Source)
      at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
      at com.cloudant.client.org.lightcouch.CouchDbClient.execute(CouchDbClient.java:483)
      ... 15 more
  Caused by: java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at com.ibm.ws.ssl.core.WSX509TrustManager.checkServerTrusted(WSX509TrustManager.java:290)
      at [internal classes]
      at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)
      ... 32 more
  </code></pre>