title: SMTP STARTTLS: how to behave if remote SMTP server has self-signed certificate?
body: <p>When SMTP client connects to remote SMTP server and issues STARTTLS command, which has self-signed certificate - I get the error in client side: </p>
  
  <blockquote>
    <p>javax.net.ssl.SSLHandshakeException:
    sun.security.validator.ValidatorException: PKIX path building failed:
    sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target</p>
  </blockquote>
  
  <p>There is one solution to trust all certificates like:</p>
  
  <pre><code>SSLContext trustAllSSLContext;
  
  TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
  
                  @Override
                  public X509Certificate[] getAcceptedIssuers() {
                      return null;
                  }
  
                  @Override
                  public void checkClientTrusted(X509Certificate[] certs, String authType) {
                  }
  
                  @Override
                  public void checkServerTrusted(X509Certificate[] certs, String authType) {
                  }
              }};
  
              try {
                  trustAllSSLContext = SSLContext.getInstance("SSL");
                  trustAllSSLContext.init(null, trustAllCerts, null);
              } catch (NoSuchAlgorithmException | KeyManagementException ex) {
                  //...
              }
  </code></pre>
  
  <p>But this causes security vulnerabilities. I think maybe this is better than to send unencrypted data in this case?</p>