title: Caused by: sun.security.validator.ValidatorException: PKIX path building failed
body: <p>Thanks Vladimir. After having included my second ADFS configuration and tried to access the same under the metadata page, I got the following exception in the app server console:</p>
  
  <pre><code>Error retrieving metadata from //&lt;adfs_server2&gt;/FederationMetadata/2007-06/FederationMetadata.xml
  javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.Su
  nCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:860)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
          at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728)
          at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
          at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
          at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
          at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828)
          at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116)
          at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
          at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
          at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
          at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
          at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
          at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:250)
          at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:255)
          at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:23
  6)
          at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
          at org.springframework.security.saml.metadata.ExtendedMetadataDelegate.initialize(ExtendedMetadataDelegate.java:167)
          at org.springframework.security.saml.metadata.MetadataManager.initializeProvider(MetadataManager.java:398)
          at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:246)
          at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86)
          at org.springframework.security.saml.metadata.MetadataGeneratorFilter.processMetadataInitialization(MetadataGeneratorFilter.java:137
  )
          at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
          at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
          at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
          at java.lang.Thread.run(Thread.java:745)
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
   unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
          at sun.security.validator.Validator.validate(Validator.java:260)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
          at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351)
          ... 48 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
          ... 54 more
  - Next refresh cycle for metadata provider '//&lt;adfs_server2&gt;/FederationMetadata/2007-06/FederationMetadata.xml' will occur on
  '2014-09-23T11:58:38.338Z' ('2014-09-23T07:58:38.338-04:00' local time)
  - Metadata provider failed to properly initialize, fail-fast=true, halting
  org.opensaml.saml2.metadata.provider.MetadataProviderException: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error retrie
  ving metadata from //&lt;adfs_server2&gt;/FederationMetadata/2007-06/FederationMetadata.xml
          at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:267)
          at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:23
  6)
          at org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
          at org.springframework.security.saml.metadata.ExtendedMetadataDelegate.initialize(ExtendedMetadataDelegate.java:167)
          at org.springframework.security.saml.metadata.MetadataManager.initializeProvider(MetadataManager.java:398)
          at org.springframework.security.saml.metadata.MetadataManager.refreshMetadata(MetadataManager.java:246)
          at org.springframework.security.saml.metadata.CachingMetadataManager.refreshMetadata(CachingMetadataManager.java:86)
          at org.springframework.security.saml.metadata.MetadataGeneratorFilter.processMetadataInitialization(MetadataGeneratorFilter.java:137
  )
          at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86)
          at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
          at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
          at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
          at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
          at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
          at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
          at java.lang.Thread.run(Thread.java:745)
  Caused by: org.opensaml.saml2.metadata.provider.MetadataProviderException: Error retrieving metadata from //&lt;adfs_server2&gt;/Fed
  erationMetadata/2007-06/FederationMetadata.xml
          at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:274)
          at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:255)
          ... 30 more
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.
  certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:860)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
          at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728)
          at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
          at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
          at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
          at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828)
          at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116)
          at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
          at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
          at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
          at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
          at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
          at org.opensaml.saml2.metadata.provider.HTTPMetadataProvider.fetchMetadata(HTTPMetadataProvider.java:250)
          ... 31 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
   unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
          at sun.security.validator.Validator.validate(Validator.java:260)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
          at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351)
          ... 48 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target....
  </code></pre>
  
  <p>I do added the corresponding FederatedMetadata.xml file in the classpath as well.</p>
  
  <p>My Configuration in securityContext.xml file looks like this:</p>
  
  <pre><code>&lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
  &lt;constructor-arg&gt;
  &lt;list&gt;
  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"&gt;
  &lt;constructor-arg&gt;
  &lt;bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"&gt;
  &lt;constructor-arg&gt;
  &lt;value type="java.io.File"&gt;classpath:metadata/services/FederationMetadata.xml&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;property name="parserPool" ref="parserPool"/&gt;
  &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  &lt;constructor-arg&gt;
  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
  &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  &lt;bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"&gt;
  &lt;!-- URL containing the metadata --&gt;
  &lt;constructor-arg&gt;
  &lt;value type="java.lang.String"&gt;://&lt;adfs_server1&gt;/FederationMetadata/2007-06/FederationMetadata.xml&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;!-- Timeout for metadata loading in ms --&gt;
  &lt;constructor-arg&gt;
  &lt;value type="int"&gt;5000&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;property name="parserPool" ref="parserPool"/&gt;
  &lt;/bean&gt;
  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadataDelegate"&gt;
  &lt;constructor-arg&gt;
  &lt;bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"&gt;
  &lt;constructor-arg&gt;
  &lt;value type="java.io.File"&gt;classpath:metadata/capital/FederationMetadata.xml&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;property name="parserPool" ref="parserPool"/&gt;
  &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  &lt;constructor-arg&gt;
  &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
  &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  &lt;bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"&gt;
  &lt;!-- URL containing the metadata --&gt;
  &lt;constructor-arg&gt;
  &lt;value type="java.lang.String"&gt;://&lt;adfs_server2&gt;/FederationMetadata/2007-06/FederationMetadata.xml&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;!-- Timeout for metadata loading in ms --&gt;
  &lt;constructor-arg&gt;
  &lt;value type="int"&gt;5000&lt;/value&gt;
  &lt;/constructor-arg&gt;
  &lt;property name="parserPool" ref="parserPool"/&gt;
  &lt;/bean&gt;
  &lt;/list&gt;
  &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Please advice</p>