SSL错误:找不到请求目标的有效证书路径
我正试图通过需要证书的服务器连接到url。我已经将我的客户机身份验证证书导入到{JAVA_HOME}/jre/bin/security/cacerts,并且我已经将它放在Jboss/bin和Jboss/server/conf/的密钥库中,然后我重新启动了服务器,它仍然给我以下错误SSL错误:找不到请求目标的有效证书路径,ssl,jboss,ssl-certificate,x509certificate,pkix,Ssl,Jboss,Ssl Certificate,X509certificate,Pkix,我正试图通过需要证书的服务器连接到url。我已经将我的客户机身份验证证书导入到{JAVA_HOME}/jre/bin/security/cacerts,并且我已经将它放在Jboss/bin和Jboss/server/conf/的密钥库中,然后我重新启动了服务器,它仍然给我以下错误 Caused by: java.io.IOException: Could not transmit message at org.jboss.ws.core.client.HTTPRemotingConnec
Caused by: java.io.IOException: Could not transmit message
at org.jboss.ws.core.client.HTTPRemotingConnection.invoke(HTTPRemotingConnection.java:265)
at org.jboss.ws.core.client.SOAPProtocolConnectionHTTP.invoke(SOAPProtocolConnectionHTTP.java:71)
at org.jboss.ws.core.CommonClient.invoke(CommonClient.java:340)
at org.jboss.ws.core.jaxws.client.ClientImpl.invoke(ClientImpl.java:290)
... 40 more
Caused by: org.jboss.remoting.CannotConnectException: Can not connect http client invoker after 1 attempt(s)
at org.jboss.remoting.transport.http.HTTPClientInvoker.makeInvocation(HTTPClientInvoker.java:249)
at org.jboss.remoting.transport.http.HTTPClientInvoker.transport(HTTPClientInvoker.java:161)
at org.jboss.remoting.MicroRemoteClientInvoker.invoke(MicroRemoteClientInvoker.java:165)
at org.jboss.remoting.Client.invoke(Client.java:1724)
at org.jboss.remoting.Client.invoke(Client.java:629)
at org.jboss.ws.core.client.HTTPRemotingConnection.invoke(HTTPRemotingConnection.java:243)
... 43 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1611)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1035)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:124)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1139)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:904)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230)
at org.jboss.remoting.transport.http.HTTPClientInvoker.getOutputStream(HTTPClientInvoker.java:1214)
at org.jboss.remoting.transport.http.HTTPClientInvoker.useHttpURLConnection(HTTPClientInvoker.java:334)
at org.jboss.remoting.transport.http.HTTPClientInvoker.makeInvocation(HTTPClientInvoker.java:231)
... 48 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:294)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:200)
at sun.security.validator.Validator.validate(Validator.java:218)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014)
... 62 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:289)
... 68 more
我想问我能做些什么来修复它?对于此证书,是否需要在server.xml中添加以下内容之一:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150"
scheme="https" secure="false" strategy="ms" address="${jboss.bind.address}"
keystoreFile="${jboss.server.home.dir}/conf/.keystore"
keystorePass="changeit" sslProtocol="TLS"
truststoreFile="/usr/lib/jvm/java-6-sun-1.6.0.10/jre/lib/security/cacerts"
truststorePass="*****"
SSLImplementation="org.jsslutils.extra.apachetomcat6.JSSLutilsImplementation"
acceptAnyCert="true" clientAuth="want" />
还是我犯了其他错误?如果是客户端证书,那么您需要将其放入您的信任库中;如果它是一个服务器证书,那么它将进入您的密钥库。此外,如果您的证书具有中间CA证书,您也需要添加它们。对于SSL Web服务配置,我们必须执行以下步骤: 1) 将CA证书插入密钥库您可以将其放入JVM或jre安全目录,也可以导入jre默认密钥库 2) 将带有密钥的身份验证证书导入密钥库(可能是java密钥库或其他密钥库)。密钥库也可以是jks,而不仅仅是pkcs12。我已经测试过了,jks也很好用 3) 当我们启动Jboss时,告诉JVM您需要这个密钥库。它可以是这样的(在我的例子中,它看起来是这样的):
还可以对证书进行顺序编码或基于64。这意味着您可能需要使用开放式SSL等来转换证书。另一个问题是,有时转换可能会导致问题,因此您可以使用这种方法进行更简单、更灵活的转换 我知道您说过您已经导入了证书,但请查看以下步骤,看看您是否遗漏了某个步骤: 下面是如何导入证书以修复以下错误的总体摘要: 尝试执行请求时出错。 javax.net.ssl.SSLHandshakeException: sun.security.validator.validator异常:PKIX路径生成失败: sun.security.provider.certpath.SunCertPathBuilderException:无法 找到请求目标的有效证书路径 如何导入证书
- 单击“更多信息”>“安全”>“显示证书”>“详细信息”>“导出…”
- 另存为
.der
- 对需要导入的所有证书重复此操作
sudo keytool -import -alias mysitestaging -keystore $JAVA_HOME/jre/lib/security/cacerts -file staging.der
sudo keytool -import -alias mysiteprod -keystore $JAVA_HOME/jre/lib/security/cacerts -file prod.der
sudo keytool -import -alias mysitedev -keystore $JAVA_HOME/jre/lib/security/cacerts -file dev.der
keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts
-Djavax.net.ssl.trustStore="$JAVA_HOME/jre/lib/security/cacerts"
-Djavax.net.ssl.trustStorePassword="changeit"
我之所以面临这个问题,是因为禁用了TLSv1.2协议。我通过在VM参数中添加TLSv1.2解决了这个问题。下面是启用协议的步骤 您需要在vm参数-->
-Dhttps.protocols=TLSv1.1、TLSv1.2中添加此行
转到eclipse中的服务器选项卡>>双击wildfly>>打开启动配置>>最后粘贴到vm参数中的行上方。为什么要使用jSSLutils进行此操作(为什么在此处接受任何证书)?为什么要将客户端证书导入默认的cacerts
?为什么还要用默认值指定信任库?是您的服务器需要证书,还是您尝试访问的远程服务器?我应该如何使其工作?如果是远程服务器,则您的服务器是客户端。这是您需要正确配置的客户端代码。忘记这些不寻常的连接器设置。不,抱歉。我不确定远程服务器。所以,我的服务器就是我调用这个需要证书的url的服务器。我只需要在调用此url时使用证书。现在,我必须将这个证书导入到某个地方(我不确定是哪个目录或密钥存储),以便在我尝试访问url时,它可以使用该证书并输入url。然后,我可以从该url执行所需的操作。现在,当它调用url时,我得到了上面提到的错误。您能解释一下我应该在哪里导入该证书以及任何其他缺少的步骤吗?是的,就与其他服务器的连接而言,您的服务器实际上是一个客户端。检查你的webapp做什么。你能展示一下你是如何调用url的吗。在pastebin或类似的地方发布代码。尝试1次后无法连接http客户端调用程序-是否应为https?我认为你这样调用是错误的
-Djavax.net.ssl.trustStore="$JAVA_HOME/jre/lib/security/cacerts"
-Djavax.net.ssl.trustStorePassword="changeit"