title: How to connect a Java client to Azure Cosmos db emulator on Windows 10, can't find cert
body: <p><strong>Problem</strong>: My demo code client unable to connect to the Azure Cosmos emulator on Windows 10.</p>
  <p><strong>Steps</strong>:</p>
  <ol>
  <li><p>I installed the Cosmosdb emulator on Windows - looks fine</p>
  </li>
  <li><p>As per documentation, I started the Windows cert manage.msc. I selected private cert with friendly name &quot;DocumentDBEmulatorCertificate&quot; as base64 encoded x.509.cer file to local disk</p>
  </li>
  <li><p>I started the cmd console in Windows as administrator and cd to local JAVA_HOME/lib/security directory (I'm using Java 8.0.131)</p>
  </li>
  <li><p>I ran keytool with this</p>
  <blockquote>
  <p>keytool -import -trustcacerts -keystore cacerts -storepass changeit -noprompt -alias azureCosmossDBEmulator -file &quot;D:\exported certificates\cosmossDB-emulator-cert.cer&quot;</p>
  </blockquote>
  </li>
  <li><p>I listed out the revised keystore to <code>dump.txt</code> file.  I can see my entry in the dump</p>
  <blockquote>
  <p>azurecosmossdbemulator, 30-Aug-2017, trustedCertEntry,
  Certificate fingerprint (SHA1): 5B:F4:14:BE:9F:2B:7F:6A:2B:C0:87:A4:3E:4D:9A:52:45:FA:2F:EA</p>
  </blockquote>
  <p>and this matches the thumbprint value in the x.509 cert.</p>
  </li>
  <li><p>I restarted Intellij on my build, and checked that Java 8.0.1.3.1 was the only jdk in the project.</p>
  </li>
  <li><p>I fired up Groovy test script in debug and stepped through code. I can create DocumentClient ok.</p>
  </li>
  <li><p>This is just a rough script to test connection code looks like this</p>
  <pre><code> final String key = &quot;C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==&quot;
  
   DocumentClient client = new DocumentClient(&quot;https://localhost:8081&quot;, key
               , new ConnectionPolicy(), ConsistencyLevel.Session)
  
   String dbname = &quot;familyDB&quot;
       String dblink = &quot;/dbs/$dbname&quot;
  
   //create db if not exists
   try {
       client.readDatabase(dblink,null)
       println &quot;found db $dbname&quot;
   } catch (DocumentClientException de) {
       if (de.getStatusCode() == 404) {
           Database db = new Database()
           db.id = dbname
           client.createDatabase(db, null)
           println &quot;created new DB $dbname&quot;
   } else {
       throw de
   }
   }
  </code></pre>
  </li>
  </ol>
  <p>When I get to the client.readDatabase line I get an exception like this:</p>
  <pre><code>SLF4J: Failed to load class &quot;org.slf4j.impl.StaticLoggerBinder&quot;.
  SLF4J: Defaulting to no-operation (NOP) logger implementation
  SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
  Caught: java.lang.IllegalStateException: Http client execution failed.
  java.lang.IllegalStateException: Http client execution failed.
      at com.microsoft.azure.documentdb.internal.GatewayProxy.performGetRequest(GatewayProxy.java:234)
      at com.microsoft.azure.documentdb.internal.GatewayProxy.doRead(GatewayProxy.java:89)
      at com.microsoft.azure.documentdb.internal.GatewayProxy.processMessage(GatewayProxy.java:336)
      at com.microsoft.azure.documentdb.DocumentClient$8.apply(DocumentClient.java:2985)
      at com.microsoft.azure.documentdb.internal.RetryUtility.executeDocumentClientRequest(RetryUtility.java:58)
      at com.microsoft.azure.documentdb.DocumentClient.doRead(DocumentClient.java:2991)
      at com.microsoft.azure.documentdb.DocumentClient.readDatabase(DocumentClient.java:491)
      at com.microsoft.azure.documentdb.DocumentClient$readDatabase.call(Unknown Source)
      at com.softwood.azure.client.cosmossDBClientScript.run(cosmossDBClientScript.groovy:29)
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394)
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353)
      at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:141)
      at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
      at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
      at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
      at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
      at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
      at com.microsoft.azure.documentdb.internal.GatewayProxy.performGetRequest(GatewayProxy.java:231)
      ... 8 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      ... 20 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      ... 20 more
  </code></pre>
  <p>which basically states it can't find my cacert entry and refuses to connect.</p>
  <p>What's gone wrong? (I haven't restarted Windows yet). The cert looks ok, the import seemed to work via keytool into cacerts, I'm using single jdk ref, but code won't connect.</p>
  <p>How can I unravel what I have not done correctly, and must now do to have the code connect from Java into Azure DB emulator running locally in my Windows 10 machine?</p>