title: CAS + SSLHandshakeException + ValidatorException + PKIX path building failed + unable to find valid certification path to requested target
body: <p>I am working on Central Authentication System (jasig.org) to implementing Single Sign On featute 
  for my intranet web application. I have two tomcat instance running in my same machine(windows).
  Both tomcat instance have been configured to use SSL and have used self-signed sertificate (created using java keytool).</p>
  
  <h1>Tomcat1</h1>
  
  <p>Cas Server.</p>
  
  <h2>server.xml</h2>
  
  <pre><code>&lt;Connector port="8443" maxHttpHeaderSize="8192" SSLEnabled="true"
                 maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
                 enableLookups="false" disableUploadTimeout="true"
                 acceptCount="100" scheme="https" secure="true"
                 clientAuth="false" sslProtocol="TLS" 
             keystoreFile="C:/Users/sandip.paul/.keystore"
             keystorePass="changeit"
             truststoreFile="C:/Program Files/Java/jdk1.6.0_20/jre/lib/security/cacerts" /&gt;
  </code></pre>
  
  <h1>Tomcat2</h1>
  
  <p>myWebApp(using spring security)</p>
  
  <h2>server.xml</h2>
  
  <pre><code>&lt;Connector port="8663" maxHttpHeaderSize="8192" SSLEnabled="true"
                 maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
                 enableLookups="false" disableUploadTimeout="true"
                 acceptCount="100" scheme="https" secure="true"
                 clientAuth="false" sslProtocol="TLS" /&gt;
  </code></pre>
  
  <p>below is the applicationContext-security.xml file of the myWebApp</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns:security="http://www.springframework.org/schema/security"
      xmlns="http://www.springframework.org/schema/beans" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                          http://www.springframework.org/schema/security
                          http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"&gt;
  
      &lt;!--
          Enable security, let the casAuthenticationEntryPoint handle all intercepted urls.
          The CAS_FILTER needs to be in the right position within the filter chain.
      --&gt;
      &lt;security:http entry-point-ref="casProcessingFilterEntryPoint" auto-config="true"&gt;
          &lt;security:intercept-url pattern="/protected/**" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;/security:http&gt;
  
      &lt;!--
          Required for the casProcessingFilter, so define it explicitly set and
          specify an Id Even though the authenticationManager is created by
          default when namespace based config is used.
      --&gt;
      &lt;security:authentication-manager alias="authenticationManager" /&gt;
  
      &lt;!--
          This section is used to configure CAS. The service is the
          actual redirect Client URL that will be triggered after the CAS login sequence.
      --&gt;
      &lt;bean id="serviceProperties" class="org.springframework.security.ui.cas.ServiceProperties"&gt;
          &lt;property name="service" value="https://obll1973.abc.com:8663/myWebApp/j_spring_cas_security_check"/&gt;
          &lt;property name="sendRenew" value="false"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- 
          The customUserDetailsService provides ROLE &amp; other Details and 
          create an object of UserDetail for this application.
      --&gt;
      &lt;bean id="customUserDetailsService"
          class="edu.sandip.cas.client.authentication.CustomUserDetailsService"&gt;
      &lt;/bean&gt;
  
      &lt;!-- 
          The CasProcessingFilter has very similar properties to the 
          AuthenticationProcessingFilter (used for form-based logins).
  
          The CAS Processing filter handles the redirect from the CAS server 
          and starts the ticket validation.
      --&gt;
      &lt;bean id="casProcessingFilter" class="org.springframework.security.ui.cas.CasProcessingFilter"&gt;
          &lt;security:custom-filter after="CAS_PROCESSING_FILTER"/&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="authenticationFailureUrl" value="/casfailed.jsp"/&gt;
          &lt;property name="defaultTargetUrl" value="/"/&gt;
      &lt;/bean&gt;
  
      &lt;!--
          The entryPoint intercepts all the CAS authentication requests.
          It redirects to the CAS loginUrl for the CAS login page.
      --&gt;
      &lt;bean id="casProcessingFilterEntryPoint" 
          class="org.springframework.security.ui.cas.CasProcessingFilterEntryPoint"&gt;
          &lt;property name="loginUrl" value="https://obll1973.abc.com:8443/cas/login"/&gt;
          &lt;property name="serviceProperties" ref="serviceProperties"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- 
          Handles the CAS ticket processing.
      --&gt;
      &lt;bean id="casAuthenticationProvider" 
          class="org.springframework.security.providers.cas.CasAuthenticationProvider"&gt;
          &lt;security:custom-authentication-provider /&gt;
          &lt;property name="userDetailsService" ref="customUserDetailsService" /&gt;
          &lt;property name="serviceProperties" ref="serviceProperties" /&gt;
          &lt;property name="ticketValidator"&gt;
              &lt;bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"&gt;
                  &lt;constructor-arg index="0" value="https://obll1973.abc.com:8443/cas" /&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
          &lt;property name="key" value="an_id_for_this_auth_provider_only"/&gt;    
      &lt;/bean&gt;
  
      &lt;!-- 
          To access request.getRemoteUser() from client application  
      --&gt;
      &lt;bean id="wrappingFilter" class="org.jasig.cas.client.util.HttpServletRequestWrapperFilter" /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>The issue I am facing is the below exception:</p>
  
  <pre><code>java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:341)
      org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:305)
      org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:50)
      org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:207)
      org.springframework.security.providers.cas.CasAuthenticationProvider.authenticateNow(CasAuthenticationProvider.java:145)
      org.springframework.security.providers.cas.CasAuthenticationProvider.authenticate(CasAuthenticationProvider.java:131)
      org.springframework.security.providers.ProviderManager.doAuthentication(ProviderManager.java:188)
      org.springframework.security.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:46)
      org.springframework.security.ui.cas.CasProcessingFilter.attemptAuthentication(CasProcessingFilter.java:94)
      org.springframework.security.ui.AbstractProcessingFilter.doFilterHttp(AbstractProcessingFilter.java:258)
      org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
      org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:390)
      org.springframework.security.ui.logout.LogoutFilter.doFilterHttp(LogoutFilter.java:89)
      org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
      org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:390)
      org.springframework.security.context.HttpSessionContextIntegrationFilter.doFilterHttp(HttpSessionContextIntegrationFilter.java:235)
      org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
      org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:390)
      org.springframework.security.util.FilterChainProxy.doFilter(FilterChainProxy.java:175)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:236)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
  </code></pre>
  
  <p>Steps to replicate the above exception:
  1) I tried accessing myWebApp using <a href="https://obll1973.abc.com:8663/myWebApp/protected/" rel="nofollow">https://obll1973.abc.com:8663/myWebApp/protected/</a>
  2) It is getting redirected to cas server i.e. <a href="https://obll1973.abc.com:8443/cas/login" rel="nofollow">https://obll1973.abc.com:8443/cas/login</a> and after providing username/password
  Here the exception caught once myWebApp again send the request to cas server to validate the generated Token.</p>
  
  <p>Any suggestion/help would be highly appriciated.</p>