HTTPS 客户端无法连接 - PKIX 路径构建失败，但根证书存在
我有一个 Java 中的 HTTP 客户端，我收到 SSLHandshakeException 异常，并显示一条消息“PKIX 路径构建失败 [classname] 无法找到请求目标的有效证书路径”，
我进行了搜索，但所有建议似乎都是根 CA 不在信任库。除此之外...我尝试将根证书添加到信任库，并且 keytool 说
“证书已存在于别名下的系统范围 CA 密钥库中”并带有别名。
我通过访问我试图在浏览器中访问的网站（Chrome - 但没有浏览器抱怨任何问题）获得了尝试此操作的证书，并且我导出了链中的根证书。然后我尝试导入上面的结果（当时我中止了导入）。
我现在不知道如何解决这个问题。
我注意到证书链中的浏览器显示了 CA 的第二个证书（因此 CA 证书 1 -> CA 证书 2 -> 目标证书），我想我可以尝试导入该证书，但我觉得我正在拍摄这里黑暗。
我还缺少其他东西吗？
I have an HTTP client in Java that I getting an SSLHandshakeException with a message of "PKIX path building failed [classname] unable to find valid certification path to requested target"
I searched but all suggestions seem to be that the root CA is not in the truststore. Except that... I tried to add the root certificate to the truststore and keytool said
"Certificate already exists in system-wide CA keystore under alias" with the alias name.
And I got the certificate to try this by going to the site I am trying to hit in a browser (Chrome - but no browsers are complaining of any problems) and I exported the root certificate in the chain. Which I then tried to import with results above (I aborted the import at that time).
I'm not sure how to fix this at this point.
I note that the browser in the certificate chain shows a second certificate for the CA (so CA certificate 1 -> CA certificate 2 -> target certificate) and I guess I can try and import that one but I feel I am shooting in the dark here.
Is there something else I am missing?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
为了使证书被视为有效，您必须拥有从该证书到受信任根证书的完整路径。
通常，这是通过服务器将所有必要的证书传递给客户端来完成的。但是，某些 Web 服务器不这样做，而是仅提供自己的证书。
看来您可能遇到过这种配置错误的服务器。尝试将中间证书导入到本地信任存储中，以便客户端能够构建从服务器证书到受信任根的完整链。还要记住
-trustcacerts选项。In order for a certificate to be considered valid, you must have a complete path from it to a trusted root certificate.
Generally this is accomplished by the server delivering all necessary certs to the client. However, some web servers do not do this, instead only providing their own certificate.
It seems likely that you have encountered such a misconfigured server. Try importing the intermediary certificate into your local trust store, so that the client will be able to build a complete chain from the server cert to the trusted root. Remember also the
-trustcacertsoption.