title: Certificate chaining error in Websphere
body: <p>I am trying to consume a RESTful service from url <a href="https://someurl.com" rel="nofollow">https://someurl.com</a>.
  I have added the following properties in my code:</p>
  
  <pre><code> Security.setProperty("ssl.SocketFactory.provider", "com.ibm.jsse2.SSLSocketFactoryImpl");
   Security.setProperty("ssl.ServerSocketFactory.provider", "com.ibm.jsse2.SSLServerSocketFactoryImpl");
   Security.setProperty("javax.net.ssl.trustStore", "cacerts.jks");
   Security.setProperty("javax.net.ssl.keyStore", "keystore.jks");
   Security.setProperty("javax.net.ssl.keyStoreType", "pkcs12");
   Security.setProperty("javax.net.ssl.trustStoreType", "JKS");
  </code></pre>
  
  <p>The configuration changes that I have done so far are:</p>
  
  <ol>
  <li>set <code>com.ibm.websphere.ssl.retrieveLeafCert</code> to <code>true</code></li>
  <li>retrieved the certificate using url as someurl and port 443 and added it to the truststore.</li>
  <li>restarted the server</li>
  </ol>
  
  <p>But I am getting the following exception:</p>
  
  <pre><code>java.security.cert.CertPathValidatorException: Certificate chaining error
  javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path building failed:          java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
    java.security.cert.CertPathValidatorException: The certificate issued by CN=Walmart Root CA, O=Wal-Mart Stores Inc is not trusted; internal cause is:
    java.security.cert.CertPathValidatorException: Certificate chaining error
    at com.ibm.jsse2.o.a(o.java:22)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:423)
    at com.ibm.jsse2.kb.a(kb.java:192)
    at com.ibm.jsse2.kb.a(kb.java:176)
    at com.ibm.jsse2.lb.a(lb.java:53)
    at com.ibm.jsse2.lb.a(lb.java:464)
    at com.ibm.jsse2.kb.s(kb.java:545)
    at com.ibm.jsse2.kb.a(kb.java:530)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:79)
    at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:437)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:142)
    at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:686)
    at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:98)
    at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:13)
    at com.ibm.net.ssl.www2.protocol.https.b.connect(b.java:6)
    at com.dwl.tcrm.tester.RESTClient_2.main(RESTClient_2.java:76)
  </code></pre>