PKIX path building failed in Java application

Solution 1:

I ran into similar issues whose cause and solution turned out both to be rather simple:

Main Cause: Did not import the proper cert using keytool

NOTE: Only import root CA (or your own self-signed) certificates

NOTE: don't import an intermediate, non certificate chain root cert

Solution Example for imap.gmail.com

1. Determine the root CA cert:

   openssl s_client -showcerts -connect imap.gmail.com:993
   

   in this case we find the root CA is Equifax Secure Certificate Authority

2. Download root CA cert.
3. Verify downloaded cert has proper SHA-1 and/or MD5 fingerprints by comparing with info found here

4. Import cert for javax.net.ssl.trustStore:

   keytool -import -alias gmail_imap -file Equifax_Secure_Certificate_Authority.pem
   

5. Run your java code

Solution 2:

You've imported the certificate into the truststore of the JRE provided in the JDK, but you are running the java.exe of the JRE installed directly.

EDIT

For clarity, and to resolve the morass of misunderstanding in the commentary below, you need to import the certificate into the cacerts file of the JRE you are intending to use, and that will rarely if ever be the one shipping inside the JDK, because clients won't normally have a JDK. Anything in the commentary below that suggests otherwise should be ignored as not expressing my intention here.

A far better solution would be to create your own truststore, starting with a copy of the cacerts file, and specifically tell Java to use that one via the system property javax.net.ssl.trustStore.

You should make building this part of your build process, so as to keep up to date with changes I the cacerts file caused by JDK upgrades.

Solution 3:

If you are using Eclipse just cross check in Eclipse Windows--> preferences---->java---> installed JREs is pointing the current JRE and the JRE where you have configured your certificate. If not remove the JRE and add the jre where your certificate is installed