Quick Answer
The “pkix path building unable to find valid certification path to requested target” error means your Java application cannot validate a server’s SSL certificate. To fix this, you must download the server’s certificate (as a .cer or .crt file) and import it into your Java environment’s cacerts truststore using the keytool -import command.
If you are developing or running a Java application that connects to external APIs or databases over HTTPS, you have likely encountered the infamous SSLHandshakeException. Specifically, the error reads:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
This exception occurs when Java’s certificate validation process (PKIX) cannot build a trust path from the server’s certificate to a trusted root certificate. Essentially, Java doesn’t trust the server you are trying to connect to. Let’s break down why this happens and how to fix it step-by-step.
Why Does This Error Occur?
Java maintains its own isolated certificate store, typically located in the jre/lib/security/cacerts directory. If a certificate is missing from this file, the connection is blocked. Common causes include:
- Self-Signed Certificates: The server uses a self-signed certificate which is inherently not trusted by default.
- Missing Intermediate Certificates: The certificate chain presented by the server is incomplete.
- Outdated Truststore: Your Java runtime might be out of date and lack the newest root certificates from Certificate Authorities.
- Corporate Proxies: A proxy or firewall (MITM) is intercepting SSL traffic and injecting its own untrusted certificate.
Understanding the Certificate Chain
| Certificate Type | Role in PKIX Path | Usually Kept In |
|---|---|---|
| Root CA | The ultimate source of trust (e.g., DigiCert, Let’s Encrypt). | Java cacerts Truststore |
| Intermediate CA | Acts as a bridge between the Root CA and the Server. | Provided by the Server |
| Leaf Certificate | The specific certificate issued to the domain you are calling. | Provided by the Server |
Step-by-Step Fix: Importing the Certificate
Step 1: Download the Server Certificate
First, you need to extract the certificate from the target server.
- Open your web browser (Chrome, Firefox, or Edge) and navigate to the HTTPS URL that is failing.
- Click on the padlock icon next to the URL address.
- Navigate to Details -> Export (or “Copy to File”).
- Save the file as a DER-encoded binary X.509 or Base64
.cerfile (e.g.,example.cer).
Step 2: Locate your Java cacerts File
You must import the certificate into the exact JDK or JRE installation your application is using. By default, the keystore is located at $JAVA_HOME/jre/lib/security/cacerts (or lib/security/cacerts in newer JDKs).
Step 3: Import using Keytool
Open your command prompt or terminal as an Administrator and run the following keytool command, replacing the paths with your actual directories:
keytool -import -alias myServerCert -keystore "C:\Program Files\Java\jdk-11\lib\security\cacerts" -file example.cer
When prompted for a password, enter the default truststore password: changeit. Type “yes” when asked if you want to trust the certificate.
Important: After importing the certificate, you must completely restart your Java application or Tomcat server for the changes to take effect.
If you are working heavily with APIs, it is crucial to understand certificate authorities properly. You can read more about how trust chains work at Let’s Encrypt. Additionally, check out our internal guide on Securing Java API Connections to prevent future handshake failures.
TL;DR
- The PKIX path building failed error happens when Java lacks the root or intermediate certificate required to trust an SSL connection.
- To resolve it, download the missing certificate via your browser.
- Use the
keytool -importcommand to add it to your Javacacertskeystore. - The default password for the keystore is
changeit. - Restart your application to apply the new trust chain.
