When trying to access a third party webservice’s staging environment, we experienced a problem with their SSL certificate. When trying to make a SOAP request against their server, we were getting:
"unable to find valid certification path to requested target".
In order to troubleshoot the SSL issues, you can turn on debugging in the glassfish container by setting the JVM option. It shows you every cert that it loads as well as the cacert file that it is using.
-Djavax.net.debug=ssl
openssl
I Also discovered a useful command that would let me investigate the SSL problems and see the cert that was being sent. I used this to determine that the certificate wasn’t sending the whole certificate chain.
$openssl s_client -connect staging.example.com:443
CONNECTED(00000003)
depth=0 /O=*.example.com/OU=Domain Control Validated/CN=*.example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /O=*.example.com/OU=Domain Control Validated/CN=*.example.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /O=*.example.com/OU=Domain Control Validated/CN=*.example.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/O=*.example.com/OU=Domain Control Validated/CN=*.example.com
i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFYTCCBEmgAwIBAgIHKAMC7TRRezANBgkqhkiG9w0BAQUFADCByjELMAkGA1UE
InstallCert.java
Initially, to add the cert to the repository, I found a post that pointed me in the right direction. The InstallCert.java seemed promising. It creates a jssecacerts file in the directory you run it. It contains the contents of the JRE_HOME/lib/security/cacerts file, plus the cert you choose to add. You need to then copy the jssecacerts file on top of the original cacerts file (after you back it up).
java -djava.home=/Library/Java/JavaVirtualMachines/1.7.0.jdk/Contents/Home/jre InstallCert www.example.com:443
With the cert I was using, it still kept failing for me. When I investigated the code of InstallCert.java, it was throwing an UnsupportedOperation exception when I tried running it again to see if it worked. Since it was old code, I gave up on that tool and decided to do it manually through the keytool.
keytool
After obtaining the cert (using firefox to view the cert and then exporting it), I ran the following command:
keytool -import -trustcacerts -alias example -storepass "changeit" -file example.pem -keystore $GLASSFISH_CONFIG/cacerts.jks
You can find the GLASSFISH directory by looking at the log file in eclipse. On my Mac, it was:
/Applications/eclipse/plugins/oracle.eclipse.runtime.glassfish312_3.1.2.0/glassfish3/glassfish/domains/domain1/config
You can verify that it was added by running:
keytool -list -v -keystore cacerts.jks
You should see your cert by looking for the alias you created.