PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Question

Folks - 
 
 I am seeing this error message when calling this API: 
 */content?helpContext=home&search=welcome

errors" : { 
 "runtime_exception" : "I/O error on GET request for \""">thebridge-adp-com.telligenthosting.net/.../search.json\":&#160;sun.security.validator.ValidatorException:&#160;PKIX&#160;path&#160;building&#160;failed:&#160;sun.security.provider.certpath.SunCertPathBuilderException:&#160;unable&#160;to&#160;find&#160;valid&#160;certification&#160;path&#160;to&#160;requested&#160;target;&#160;nested&#160;exception&#160;is&#160;javax.net.ssl.SSLHandshakeException:&#160;sun.security.validator.ValidatorException:&#160;PKIX&#160;path&#160;building&#160;failed:&#160;sun.security.provider.certpath.SunCertPathBuilderException:&#160;unable&#160;to&#160;find&#160;valid&#160;certification&#160;path&#160;to&#160;requested&#160;target" 
 }

Robert Hanson · Accepted Answer

This means that your client application (which appears to be written in Java) can't validate the SSL certificate for the server. Your options are either to (1) make sure that you have the appropriate certs installed on your client server, or (2) have your client ignore the error. 
 If the server is using a self-signed SSL cert, then that is the cause. Your should google this error (this error isn't a Verint Community error, it is a common Java error) and see what you find. I would stick to the solutions you find on StackOverflow.com, these will most likely be the best and most complete. If you don't work with certs often (like me) you may end up pulling out some of your hair trying to figure it out, but the info is out there. 
 If you are using an older version of Java, upgrade Java. The Java distribution will include the certs for well known certificate authorities. Note that if you are using Java 8 (or whatever), you can usually just upgrade the the most recent patch level for that same version, and that may include the certs you need without needing to go to the most recent major version. When possible, this is the easiest approach. 
 If you don't want to go through the hassle of installing the cert on your client server, you can ignore the error. The method for ignoring SSL errors differ based on the client library you are using. Again, use google to find the appropriate resources, there are at least a few good ones out there. Unless your client library has an "ignore SSL errors" switch you will likely need to create your own SSL cert checker class, and just have it always return true. Here is an example if you use Commons HttpClient https://stackoverflow.com/questions/2703161/how-to-ignore-ssl-certificate-errors-in-apache-httpclient-4-0 .

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Top Replies