来自 Windows 命令行的 SOAP Web 服务中的 SSL 证书问题答案

【问题标题】：SSL certificate issue in SOAP webservice from Windows commandline来自 Windows 命令行的 SOAP Web 服务中的 SSL 证书问题
【发布时间】：2017-07-25 13:16:33
【问题描述】：

当我在 Eclipse 上运行 Java 项目时，它能够通过 SOAP Web 服务访问应用程序服务器。但是我在从命令提示符处将其作为 JAR 文件运行时遇到了 SSL 证书问题。我还验证了导入的证书。我想知道为什么它只在命令提示符下失败。有什么需要配置的吗？请指教。

C:\Users\Admin\Desktop>java -jar Javaapp.jar
[Ljava.lang.StackTraceElement;@4ec6a292
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
)
        at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source)
        at sun.security.ssl.AppOutputStream.write(Unknown Source)
        at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
        at java.io.BufferedOutputStream.flush(Unknown Source)
        at java.io.FilterOutputStream.flush(Unknown Source)
        at org.apache.commons.httpclient.methods.StringRequestEntity.writeReques
t(StringRequestEntity.java:150)
        at org.apache.commons.httpclient.methods.EntityEnclosingMethod.writeRequ
estBody(EntityEnclosingMethod.java:495)
        at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodB
ase.java:1973)
        at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.j
ava:993)
        at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(Htt
pMethodDirector.java:397)
        at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMe
thodDirector.java:170)
        at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.jav
a:396)
        at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.jav
a:324)
        at com.thunderhead.utility.Thunderheadrelease.sendHTTPPostRequest(Thunde
rheadrelease.java:280)
        at com.thunderhead.utility.Thunderheadrelease.main(Thunderheadrelease.ja
va:108)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find vali
d certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
        at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
        at sun.security.validator.Validator.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Sour
ce)
        ... 21 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Sourc
e)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown
Source)
        at java.security.cert.CertPathBuilder.build(Unknown Source)
        ... 27 more
Status Code : -1
Status Code:-1
Post Request Failed - null

【问题讨论】：

您需要将服务器的根证书包含在您的 JVM 使用的信任库中（默认为 jre/lib/security/cacerts）
谢谢。证书已使用 keytool -import -trustcacerts 导入。
然后检查您是否使用了正确的 JVM，或者您没有在 eclipse 执行中设置不同的信任库
是的，机器上有多个 JRE 版本。我们将证书复制到最新版本。它现在工作正常。感谢您的帮助。
我应该把它作为答案发布吗？

标签： java web-services security ssl soap

【解决方案1】：

该异常意味着 JVM 无法验证服务器证书。
需要将服务器证书的根证书包含在您的 JVM 使用的信任库中，并确保您使用的是正确的 JVM

默认信任库位于 JVM 主目录的 jre/lib/security/cacerts。也可以配置-Djavax.net.ssl.trustStore=/path/to/trusstore

【讨论】：