title: SSL error from Java client but works form POSTER in Firefox
body: <p>I just setup SSL certs on my server. I am pretty sure they are setup right. When go to <code>https://mydomain.com/myapp</code> in the browser the page loads correctly and the Green Lock shows in the address bar.</p>
  
  <p>Doing a POST from Firefox>POSTER to this <code>HTTPS</code> url I get a valid response.</p>
  
  <p>If I do the same POST from my Java client I get the following error:</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>On my server I have put the CA_ROOT certs in the JAVA.../jre/lib/security/cacert keystore.</p>
  
  <p>Here is my posting code from my Java client.</p>
  
  <pre><code>URL url = new URL(Global.SERVER_URL);
  HttpsURLConnection connection = null;
  connection = (HttpsURLConnection) url.openConnection();
  connection.setRequestMethod("POST");
  connection.setDoOutput(true);
  connection.setDoInput(true);
  connection.setReadTimeout(45000);
  connection.setRequestProperty("Content-Type", "text/json");
  connection.connect();
  </code></pre>
  
  <p><strong>PLease Note: THIS IS NOT A SELF SIGNED CERT. It was issued by a CA</strong></p>
  
  <p>I have a feeling that Glassfish is not sending the full Cert Chain. I looked at the cert that the browser got and it was the full cert chain. I looked at the SSL error and that was only the Intermediate Cert and that for my domain. </p>
  
  <p>How do I get Glassfish to send the full Cert chain?</p>
  
  <h2>Check SSL Chain</h2>
  
  <p><code>openssl.exe s_client -connect mydomain.com:443</code></p>
  
  <p><strong>Returns</strong></p>
  
  <pre><code>WARNING: can't open config file: /usr/local/ssl/openssl.cnf
  Loading 'screen' into random state - done
  CONNECTED(00000190)
  depth=0 C = US, ST = &lt;edited&gt;, L = &lt;edited&gt;, O = &lt;edited&gt;, OU = &lt;edited&gt;, CN = &lt;edited&gt;
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 C = US, ST = &lt;edited&gt;, L = &lt;edited&gt;, O = &lt;edited&gt;, OU = &lt;edited&gt;, CN = &lt;edited&gt;
  verify error:num=27:certificate not trusted
  verify return:1
  depth=0 C = US, ST = &lt;edited&gt;, L = &lt;edited&gt;, O = &lt;edited&gt;, OU = &lt;edited&gt;, CN = &lt;edited&gt;
  verify error:num=21:unable to verify the first certificate
  verify return:1
  ---
  Certificate chain
   0 s:/C=US/ST=&lt;edited&gt;/L=&lt;edited&gt;/O=&lt;edited&gt;/OU=&lt;edited&gt;/CN=&lt;edited&gt;
     i:/O=Cybertrust Inc/CN=Cybertrust Public SureServer SV CA
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  &lt;edited&gt;
  -----END CERTIFICATE-----
  subject=/C=US/ST=&lt;edited&gt;/L=&lt;edited&gt;/O=&lt;edited&gt;/OU=&lt;edited&gt;/CN=&lt;edited&gt;
  issuer=/O=Cybertrust Inc/CN=Cybertrust Public SureServer SV CA
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 1676 bytes and written 513 bytes
  ---
  New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES128-GCM-SHA256
      Session-ID: &lt;edited&gt;
  
      Session-ID-ctx:
      Master-Key: &lt;edited&gt;
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1410274974
      Timeout   : 300 (sec)
      Verify return code: 21 (unable to verify the first certificate)
  ---
  read:errno=0
  </code></pre>
  
  <h2>SOLUTION</h2>
  
  <p><strong>Accepted Answer from Bruno for the Concept</strong></p>
  
  <p>Additional Details:</p>
  
  <ol>
  <li>Get Keystore Explorer. Its a fantastic GUI tool to browse keystores.</li>
  <li>Open keystore.jks with Keystore Explorer.</li>
  <li>Right Click the Cert in question (mydomain) and <strong>View Details>Certificate Chain Details</strong>.</li>
  <li>if it does not show the full Cert chain then add it by right clicking the cert <strong>Edit Certificate Chain>Append Certificate</strong>.</li>
  <li>Restart Glassfish.</li>
  </ol>