title: java ssl hanshake exception
body: <p>I know there has been lots of questions regarding this ssl hand shake, I still could not figure this out. 
  I am trying to submit a java-ws soap message to <a href="https://demo296.vertexinc.com/vertex-ws/services/CalculateTax70?wsdl" rel="nofollow">link</a> and end point got proper certificate, but why java won't honor it and gives this well known exception:</p>
  
  <pre><code>Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: 
  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>When I enable network debugging, I get following:</p>
  
  <pre><code>%% No cached client session
  *** ClientHello, TLSv1
  RandomCookie:  GMT: 1460059402 bytes = { 161, 121, 184, 113, 145, 191, 213, 189, 184, 72, 172, 65, 62, 227, 170, 31, 178, 118, 248, 177, 185, 159, 199, 169, 12, 109, 219, 190 }
  Session ID:  {}
  Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_MD5, TLS_KRB5_WITH_RC4_128_SHA, TLS_KRB5_WITH_RC4_128_MD5, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5]
  Compression Methods:  { 0 }
  Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
  Extension ec_point_formats, formats: [uncompressed]
  Extension server_name, server_name: [host_name: demo296.vertexinc.com]
  ***
  http-bio-443-exec-2, WRITE: TLSv1 Handshake, length = 213
  http-bio-443-exec-2, READ: TLSv1 Handshake, length = 49
  *** ServerHello, TLSv1
  RandomCookie:  GMT: 1460059402 bytes = { 87, 39, 164, 163, 199, 232, 199, 16, 238, 235, 203, 206, 70, 140, 226, 224, 163, 188, 121, 208, 109, 2, 153, 126, 2, 19, 50, 82 }
  Session ID:  {}
  Cipher Suite: SSL_RSA_WITH_RC4_128_SHA
  Compression Method: 0
  Extension renegotiation_info, renegotiated_connection: &lt;empty&gt;
  ***
  %% Initialized:  [Session-2, SSL_RSA_WITH_RC4_128_SHA]
  ** SSL_RSA_WITH_RC4_128_SHA
  http-bio-443-exec-2, READ: TLSv1 Handshake, length = 1292
  *** Certificate chain
  chain [0] = [
  [
    Version: V3
    Subject: CN=*.vertexinc.com, OU=Vertex Inc., O=Vertex Inc, L=Berwyn, ST=Pennsylvania, C=US
    Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
  
    Key:  Sun RSA public key, 2048 bits
    modulus: 21011005644752221458440925799952678183823792833716434828539993186933856337574997854121938343987119300440905398000025082799836849602033704013027189447726880355089766117512592061516178819039391085455553102645007112453032938831724998233033633698493476955604784493337783750130439099745399832839029789567413380485885064049847898628887513164667338660464585157036580363609549890856904881728624134009162466528991105337058182437282700845235389976741141724118492275741871053644597590803795354460154631255971959996923189046439657231520344375967087626815565942867567333556795133804268135785335388269336344735453096564729483564909
    public exponent: 65537
    Validity: [From: Sun Nov 09 19:00:00 EST 2014,
                 To: Wed Nov 09 18:59:59 EST 2016]
    Issuer: CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US
    SerialNumber: [    254cae2c 09b790ad ef6c356f 343deac7]
  
  Certificate Extensions: 8
  [1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
  AuthorityInfoAccess [
    [
     accessMethod: ocsp
     accessLocation: URIName: http://gn.symcd.com
  , 
     accessMethod: caIssuers
     accessLocation: URIName: http://gn.symcb.com/gn.crt
  ]
  ]
  
  [2]: ObjectId: 2.5.29.35 Criticality=false
  AuthorityKeyIdentifier [
  KeyIdentifier [
  0000: D2 6F F7 96 F4 85 3F 72   3C 30 7D 23 DA 85 78 9B  .o....?r&lt;0.#..x.
  0010: A3 7C 5A 7C                                        ..Z.
  ]
  ]
  
  [3]: ObjectId: 2.5.29.19 Criticality=false
  BasicConstraints:[
    CA:false
    PathLen: undefined
  ]
  
  [4]: ObjectId: 2.5.29.31 Criticality=false
  CRLDistributionPoints [
    [DistributionPoint:
       [URIName: http://gn.symcb.com/gn.crl]
  ]]
  
  [5]: ObjectId: 2.5.29.32 Criticality=false
  CertificatePolicies [
    [CertificatePolicyId: [2.16.840.1.113733.1.7.54]
  [PolicyQualifierInfo: [
    qualifierID: 1.3.6.1.5.5.7.2.1
    qualifier: 0000: 16 33 68 74 74 70 73 3A   2F 2F 77 77 77 2E 67 65  .3https://www.ge
  0010: 6F 74 72 75 73 74 2E 63   6F 6D 2F 72 65 73 6F 75  otrust.com/resou
  0020: 72 63 65 73 2F 72 65 70   6F 73 69 74 6F 72 79 2F  rces/repository/
  0030: 6C 65 67 61 6C                                     legal
  
  ], PolicyQualifierInfo: [
    qualifierID: 1.3.6.1.5.5.7.2.2
    qualifier: 0000: 30 35 0C 33 68 74 74 70   73 3A 2F 2F 77 77 77 2E  05.3https://www.
  0010: 67 65 6F 74 72 75 73 74   2E 63 6F 6D 2F 72 65 73  geotrust.com/res
  0020: 6F 75 72 63 65 73 2F 72   65 70 6F 73 69 74 6F 72  ources/repositor
  0030: 79 2F 6C 65 67 61 6C                               y/legal
  
  ]]  ]
  ]
  
  [6]: ObjectId: 2.5.29.37 Criticality=false
  ExtendedKeyUsages [
    serverAuth
    clientAuth
  ]
  
  [7]: ObjectId: 2.5.29.15 Criticality=true
  KeyUsage [
    DigitalSignature
    Key_Encipherment
  ]
  
  [8]: ObjectId: 2.5.29.17 Criticality=false
  SubjectAlternativeName [
    DNSName: *.vertexinc.com
    DNSName: vertexinc.com
  ]
  
  ]
    Algorithm: [SHA256withRSA]
    Signature:
  0000: 8B 63 CB B1 74 E3 15 E8   24 1D C9 31 DF 0B A5 F2  .c..t...$..1....
  0010: 04 72 FF 9A CD E0 AD 36   4B E1 C6 2C 02 39 BB C2  .r.....6K..,.9..
  0020: CB 8C CE BE 60 EF 59 59   7E 20 47 90 47 9A 10 35  ....`.YY. G.G..5
  0030: C4 1C 96 3D 11 7C C0 1D   02 E5 E8 32 FC 2E E8 E5  ...=.......2....
  0040: 17 DB 52 70 C1 79 38 1B   9E 4F CF 8E 09 5B 96 EB  ..Rp.y8..O...[..
  0050: F9 FB DD 66 33 17 53 32   C7 37 AA 1D D1 84 05 D6  ...f3.S2.7......
  0060: 53 84 CA AB 5F E7 DB 0E   12 F6 82 A9 24 7A ED 3C  S..._.......$z.&lt;
  0070: ED CC 5C 77 8D 0B D3 FD   FD FA 6A 8B 34 C3 E1 2E  ..\w......j.4...
  0080: FB D8 31 B9 A1 5C BD 63   FD 66 01 00 69 D2 8A 13  ..1..\.c.f..i...
  0090: 99 08 84 66 97 65 93 93   27 B7 70 A0 07 01 4F AD  ...f.e..'.p...O.
  00A0: 5C B4 BB 79 18 18 50 CD   64 85 38 9E 5C 39 20 FB  \..y..P.d.8.\9 .
  00B0: A3 C4 97 7C 65 9F 53 ED   25 D3 7A 02 08 BC DB 28  ....e.S.%.z....(
  00C0: 09 F1 12 62 D7 9E 21 22   BF 36 B3 66 35 77 1C 6D  ...b..!".6.f5w.m
  00D0: EE E8 67 F2 49 A9 6A B1   1B B8 70 63 09 19 F2 71  ..g.I.j...pc...q
  00E0: 7C BD 6C 70 5B C1 FE 17   1A E4 80 26 55 7F F1 1D  ..lp[......&amp;U...
  00F0: BF 57 38 D2 34 49 80 13   5B DB 1F 16 C1 A6 A8 82  .W8.4I..[.......
  
  ]
  ***
  %% Invalidated:  [Session-2, SSL_RSA_WITH_RC4_128_SHA]
  http-bio-443-exec-2, SEND TLSv1 ALERT:  fatal, description = certificate_unknown
  http-bio-443-exec-2, WRITE: TLSv1 Alert, length = 2
  http-bio-443-exec-2, called closeSocket()
  http-bio-443-exec-2, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>As you can see from the end point, cert chain is coming from authority.</p>
  
  <p><a href="http://i.stack.imgur.com/UdA1I.png" rel="nofollow">screenshot</a></p>
  
  <p>GeoTrust Global CA is the root chain and included in default jdk cacerts. 
  I was thinking if root issuer is trusted and in cacerts then java should honor it, but it did not. Then 2nd cacerts chain GeoTrust SSL CA - G3 is not there and I imported it. Still did not work. I can import the entire cert chain, but why java won't honor trusted authority in this case?</p>
  
  <p>Thank you!</p>