Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

how to fix exception of unable to find valid certification path to requested target #1443

Closed
youjieqi opened this issue Sep 27, 2019 · 18 comments
Closed

how to fix exception of unable to find valid certification path to requested target #1443

youjieqi opened this issue Sep 27, 2019 · 18 comments
Labels
closed-for-staleness guidance Question that needs advice or information. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 10 days.

Comments

@youjieqi
Copy link

using jdk1.8 and SDK2.7.32

code
{
public static void main(String[] args) throws ClientException, ParseException, InterruptedException {
awsEcc();
}
private static void awsEcc()
{
Ec2Client ec2 = Ec2Client.builder().region(Region.CN_NORTHWEST_1).build();
boolean done = false;
String nextToken = null;
do {
software.amazon.awssdk.services.ec2.model.DescribeInstancesRequest request = software.amazon.awssdk.services.ec2.model.DescribeInstancesRequest.builder().maxResults(6).nextToken(nextToken).build();
software.amazon.awssdk.services.ec2.model.DescribeInstancesResponse response =ec2.describeInstances(request);
for (Reservation reservation : response.reservations()) {
for (Instance instance : reservation.instances()) {
System.out.printf(
instance.instanceId(),
}
}
nextToken = response.nextToken();
} while (nextToken != null);
}

}

Exception in thread "main" java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.intellij.rt.execution.CommandLineWrapper.main(CommandLineWrapper.java:67)
Caused by: software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:97)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.handleThrownException(RetryableStage.java:136)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.execute(RetryableStage.java:94)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:62)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:42)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:57)
at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:37)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26)
at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:240)
at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:96)
at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:120)
at software.amazon.awssdk.core.client.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:73)
at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:44)
at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:55)
at software.amazon.awssdk.services.ec2.DefaultEc2Client.describeInstances(DefaultEc2Client.java:9961)
at com.company.project.syncData.test.TestApi.awsEcc(TestApi.java:425)
at com.company.project.syncData.test.TestApi.main(TestApi.java:103)
... 5 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353)
at software.amazon.awssdk.http.apache.internal.conn.SdkTlsSocketFactory.connectSocket(SdkTlsSocketFactory.java:113)
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at software.amazon.awssdk.http.apache.internal.conn.ClientConnectionManagerFactory$Handler.invoke(ClientConnectionManagerFactory.java:80)
at com.sun.proxy.$Proxy0.connect(Unknown Source)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
at software.amazon.awssdk.http.apache.internal.impl.ApacheSdkHttpClient.execute(ApacheSdkHttpClient.java:72)
at software.amazon.awssdk.http.apache.ApacheHttpClient.execute(ApacheHttpClient.java:240)
at software.amazon.awssdk.http.apache.ApacheHttpClient.access$500(ApacheHttpClient.java:106)
at software.amazon.awssdk.http.apache.ApacheHttpClient$1.call(ApacheHttpClient.java:221)
at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.executeHttpRequest(MakeHttpRequestStage.java:66)
at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.execute(MakeHttpRequestStage.java:51)
at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.execute(MakeHttpRequestStage.java:35)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:64)
at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:36)
at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:77)
at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:39)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.doExecute(RetryableStage.java:113)
at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage$RetryExecutor.execute(RetryableStage.java:86)
... 26 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
at sun.security.validator.Validator.validate(Validator.java:262)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
... 67 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
... 73 more
@debora-ito debora-ito transferred this issue from aws/aws-sdk-java Sep 27, 2019
@debora-ito
Copy link
Member

Transferred issue to V2 repo.

@youjieqi this is probably caused by missing Amazon Trust Services certificates in your trust store, see this blog post for more detailed info.

You can check what certificates are installed in your trust store with the following command:

keytool -list -v /path/to/keystore

And ensure the certificates listed on the blog post are present:

  • CN=Amazon Root CA 1,O=Amazon,C=US
  • CN=Amazon Root CA 2,O=Amazon,C=US
  • CN=Amazon Root CA 3,O=Amazon,C=US
  • CN=Amazon Root CA 4,O=Amazon,C=US
  • CN=Starfield Services Root Certificate Authority – G2,O=Starfield Technologies, Inc.,L=Scottsdale,ST=Arizona,C=US
  • Starfield Class 2 Certification Authority

@debora-ito debora-ito added guidance Question that needs advice or information. closing-soon This issue will close in 4 days unless further comments are made. labels Sep 27, 2019
@youjieqi
Copy link
Author

the Amazon Trust Services CAs are in my trust store.All tests are ok. The exception of unable to find valid certification path to requested target is appearance from time to time. change version of Jdk does not work too.

@youjieqi
Copy link
Author

@debora-ito my log of Running shows 'Secure session was not established ,after Starting handshake by software.amazon.awssdk.http.apache.internal.conn.SdkTlsSocketFactory '

@debora-ito
Copy link
Member

my log of Running shows 'Secure session was not established ,after Starting handshake by software.amazon.awssdk.http.apache.internal.conn.SdkTlsSocketFactory '

Could you provide the full stacktrace for this exception? Please make sure you remove any sensitive data.

@youjieqi
Copy link
Author

youjieqi commented Oct 3, 2019 via email

@youjieqi
Copy link
Author

youjieqi commented Oct 3, 2019

@debora-ito i have sent the email about my full stacktrack and some queation to you

@debora-ito debora-ito removed the closing-soon This issue will close in 4 days unless further comments are made. label Oct 9, 2019
@rtehok
Copy link

rtehok commented Nov 26, 2019 •
edited

up ? I have the same issue with my application.
I managed to connect via pymongo driver and with robo 3T via ssh tunneling, but using java drivers seems to fail at ssl handshake.

I am trying to connect to documentDB via ssh tunneling and Java application

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
%% Invalidated:  [Session-9, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
nioEventLoopGroup-2-9, SEND TLSv1.2 ALERT:  fatal, description = certificate_unknown
nioEventLoopGroup-2-9, WRITE: TLSv1.2 Alert, length = 2
nioEventLoopGroup-2-9, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: General SSLEngine problem

@youjieqi
Copy link
Author

youjieqi commented Nov 27, 2019 via email

@rtehok
Copy link

rtehok commented Nov 27, 2019

Thanks for your reply.
However, I tried that on my local application and did not change anything and now, even on an amazon VPC, the pod (that could connect at earlier times) has now trouble connecting to documentDB.

09:02:00.554 DEBUG org.mongodb.driver.cluster - Updating cluster description to {type=UNKNOWN, servers=[{address=clust-xxx.eu-west-1.docdb.amazonaws.com:48977, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketWriteException: Exception sending message}, caused by {javax.net.ssl.SSLException: SSLEngine closed already}}]

@rtehok
Copy link

rtehok commented Nov 27, 2019

Actually, you were right!
I had to download the correct .pem file, the combined file does not work as-is when loading the truststore...

@youjieqi
Copy link
Author

youjieqi commented Nov 27, 2019 via email

@rtehok
Copy link

rtehok commented Nov 27, 2019

yes, I had to use the rds-ca-2019-root file to make it work correctly (not the combined one)

@lordpengwin
Copy link

Thanks @rtehok I had the same problem and your solution solved it. Is there any actual AWS information that properly documents this? Everything I see says to use the combined one.

@darkpssngr
Copy link

darkpssngr commented Feb 20, 2020 •
edited

https://docs.aws.amazon.com/documentdb/latest/developerguide/ca_cert_rotation.html
it says here in Step 1 Note that we have make sure that keystore selects CA-2019 ,not sure how to do it though.

@cmamedzade
Copy link

if you are on windows should try this
System.setProperty("javax.net.ssl.trustStore", "NUL");
System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT");

i used my comp without domain it worked but with domain you should point valid certs I think
After importing entries below error disappeared

@debora-ito
Copy link
Member

Hi everyone, it looks like the original issue was solved, so I'm going to mark this to close soon. If there's anything else pending or you have any other questions, just add a comment to prevent automatic closure or open a new issue if this one is already closed.

@debora-ito debora-ito added the response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 10 days. label Sep 9, 2020
@github-actions
Copy link

It looks like this issue hasn’t been active in longer than a week. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please add a comment to prevent automatic closure, or if the issue is already closed please feel free to reopen it.

@github-actions github-actions bot added closing-soon This issue will close in 4 days unless further comments are made. closed-for-staleness and removed closing-soon This issue will close in 4 days unless further comments are made. labels Sep 16, 2020
aws-sdk-java-automation pushed a commit that referenced this issue Jun 3, 2021
@joviegas
Merge pull request #1443 from aws/staging/8f9deb8b-ce4f-4a81-ae18-90e…
d095bca 
…4eb3d097b

Pull request: release <- staging/8f9deb8b-ce4f-4a81-ae18-90e4eb3d097b
@Maheshwaran1298
Copy link

I am also facing the same issue please tell me how to resolve this iisue "unable to execute http request pkix path building failed"

@debora-ito debora-ito mentioned this issue Jun 2, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
closed-for-staleness guidance Question that needs advice or information. response-requested Waiting on additional info and feedback. Will move to "closing-soon" in 10 days.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@debora-ito @lordpengwin @darkpssngr @rtehok @cmamedzade @youjieqi @Maheshwaran1298