title: Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?
body: <p><strong>Edit :</strong> I tried to format the question and accepted answer in more presentable way at my <a href="https://tech-geek-passion.blogspot.com/2017/09/how-to-resolve-javaxnetsslsslhandshakee.html" rel="noreferrer">blog</a>.</p>
  <p>Here is the original issue.</p>
  <p>I am getting this error:</p>
  <blockquote>
  <p>detailed message sun.security.validator.ValidatorException: PKIX path
  building failed:<br />
  sun.security.provider.certpath.SunCertPathBuilderException: unable to
  find valid certification path  to requested target</p>
  <p>cause javax.net.ssl.SSLHandshakeException:
  sun.security.validator.ValidatorException: PKIX path   building
  failed: sun.security.provider.certpath.SunCertPathBuilderException:
  unable to find valid certification path to requested target</p>
  </blockquote>
  <p>I am using Tomcat 6 as webserver. I have two HTTPS web applications installed on different Tomcats on different ports but on the same machine. Say App1 (port 8443) and  App2 (port 443). App1 connects to App2. When App1 connects to App2 I get the above error. I know this is a very common error so came across many solutions on different forums and sites. I have the below entry in <code>server.xml</code> of both Tomcats:</p>
  <pre><code>keystoreFile=&quot;c:/.keystore&quot; 
  keystorePass=&quot;changeit&quot;
  </code></pre>
  <p>Every site says the same reason that certificate given by app2 is not in the trusted store of app1 jvm. This seems to be true also when I tried to hit the same URL in IE browser, it works (with warming, There is a problem with this web site's security certificate. Here I say continue to this website). But when same URL is hit by Java client (in my case) I get the above error. So to put it in the truststore I tried these three options:</p>
  <h3>Option 1</h3>
  <pre><code>System.setProperty(&quot;javax.net.ssl.trustStore&quot;, &quot;C:/.keystore&quot;);
  System.setProperty(&quot;javax.net.ssl.trustStorePassword&quot;, &quot;changeit&quot;);
  </code></pre>
  <h3>Option 2</h3>
  <p>Setting below in environment variable</p>
  <pre><code>CATALINA_OPTS -- param name
  -Djavax.net.ssl.trustStore=C:\.keystore -Djavax.net.ssl.trustStorePassword=changeit ---param value
  </code></pre>
  <h3>Option 3</h3>
  <p>Setting below in environment variable</p>
  <pre><code>JAVA_OPTS -- param name
  -Djavax.net.ssl.trustStore=C:\.keystore -Djavax.net.ssl.trustStorePassword=changeit ---param value
  </code></pre>
  <h3>Result</h3>
  <p>But nothing worked.</p>
  <p><strong>What at last worked</strong> is executing the Java approach suggested in <a href="https://stackoverflow.com/questions/1828775/httpclient-and-ssl">How to handle invalid SSL certificates with Apache HttpClient?</a> by Pascal Thivent i.e. executing the program InstallCert.</p>
  <p><strong>But this approach is fine for devbox setup but I can not use it at production environment.</strong></p>
  <p>I am wondering why three approaches mentioned above did not work when I have mentioned the same values in <code>server.xml</code> of App2 server and same values in truststore by setting</p>
  <p><code>System.setProperty(&quot;javax.net.ssl.trustStore&quot;, &quot;C:/.keystore&quot;) and System.setProperty(&quot;javax.net.ssl.trustStorePassword&quot;, &quot;changeit&quot;);</code></p>
  <p>in App1 program.</p>
  <p>For more information this is how I am making the connection:</p>
  <pre><code>URL url = new URL(urlStr);
  
  URLConnection conn = url.openConnection();
  
  if (conn instanceof HttpsURLConnection) {
  
    HttpsURLConnection conn1 = (HttpsURLConnection) url.openConnection();
    
    conn1.setHostnameVerifier(new HostnameVerifier() {
      public boolean verify(String hostname, SSLSession session) {
        return true;
      }
    });
  
    reply.load(conn1.getInputStream());
  </code></pre>