Solving "Unable to Connect to SSL Services due to PKIX Path Building Failed sun.security.provider.certpath.SunCertPathBuilder" Exception

Problem

In this post I explain how to solve the issue that throws the following exception.

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1476)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:846)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)
 at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)
 at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:815)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1025)
 at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1038)
 at InstallCert.main(InstallCert.java:63)

Solution

The reason for this exception is that the certificate of one or both applications is not trusted by the other application, due to not being imported into the trust store of the JVM running that application. We need to install the SSL certificates that the application needs to connect over SSL, into our local keystore. 

First download InstallCert from here and compile the InstallCert.java.

javac InstallCert.java

Assume that we need to download the SSL certificate of the server at https://example.com.

To add it to your local store. Run:

java InstallCert example.com:443

These commands will create a file called jssecacerts and will be updating it with more SSL certificates every time you want to add a certificate. 

Copy this file to your java security folder (usually at $JAVA_HOME/jre/lib/security):

sudo cp jssecacerts $JAVA_HOME/jre/lib/security

And now our Java applications will be able to connect to the servers that we allowed over SSL.

Additional Operations:

Access server, and retrieve certificate.
java InstallCert [host]:[port]

Extract certificate from created jssecacerts keystore
keytool -exportcert -alias [host]-1 -keystore jssecacerts -storepass changeit -file [host].cer

Import certificate into system keystore
keytool -importcert -alias [host] -keystore [path to system keystore] -storepass changeit -file [host].cer

2. Setting up SSH password-less log in

1. Define a common user for all the machines with the same user name and make the home directory /mirror

madhawa@node0:~$ sudo useradd -d /mirror/mpiuser -m -s /bin/bash mpiuser
madhawa@node0:~$ sudo passwd mpiuser

This would prompt for a new password for the user id "mpiuser". Do the same thing to all the machines.

2. Make the mpiuser as the owner of the /mirror

madhawa@node0:~$ sudo chown mpiuser /mirror

3. Install the SSH server in all the machines.

madhawa@node0:~$ sudo apt-get install openssh-server

4. Setup the password-less log in.

login with the new user in su mode.

madhawa@node0:~$ su mpiuser

Generate DSA key pair for the mpiuser.

mpiuser@node0:~$ ssh-keygen -t dsa

This will prompt for a passphrase. Leave it empty. 

A folder called .ssh is created in /mirror/mpiuser which contains the key file. Add this key to the authorized set of keys by issuing the following commands.

mpiuser@node0:~$ cd .ssh
mpiuser@node0:~/.ssh$ cat id_dsa.pub >> authorized_keys
mpiuser@node0:~/.ssh$ chmod 644 authorized_keys 

To test the password-less login, issue the following command on the master node and if successful, this would return the host name of the nodes without asking for password or passphrase.

mpiuser@node0:~$ ssh node1 hostname

Note: Sometimes you may be prompted to enter password for once. But it won't be required again. 

Unsubscribe from spam emails in bulks

A clean inbox. Just one click away…for free!

Your inbox is a mess, and it’s time to admit defeat. Stop sorting through your emails, and start doing things you love again. "Unroll.me" is here to help you.

Sign up here!

Spring Security in the simplest possible way!

Spring security has support for almost all the security protocols being used today. Here is the introduction and list of technologies supported by Spring. In addition it supports OAuth 1.0 and 2.0 !!!

In this article, I describe Spring security at very basic level: how to implement a simple client-server authentication using Spring security. So lets take a look at the steps to do this.

• Including Spring security libraries in your classpath. If you are using eclipse put these .jar files into  WEB-INF/libs folder and add them to the build path.

 Note: These are the required srping security libraries

• spring-security-core
• spring-security-config
• sprng-security-web

• Creating the Spring security configurations file, say spring-security-context.xml. and configuring the namespaces.

my spring-security-context.xml file

Loading ....

• Adding the  spring-security-config.xml to the web.xml file so that it can be loaded as a part of the spring application context.

• Adding spring security filters

my web.xml file

Loading ....



Advanced Stuff

• SecurityContextHolder, to provide access to the SecurityContext.
• SecurityContext, to hold the Authentication and possibly request-specific security information.
• Authentication, to represent the principal in a Spring Security-specific manner.
• GrantedAuthority, to reflect the application-wide permissions granted to a principal.
• UserDetails, to provide the necessary information to build an Authentication object from your application's DAOs or other source source of security data.
• UserDetailsService, to create a UserDetails when passed in a String-based username (or certificate ID or the like).
  
  

OAuth makes life easier and safer!

This is the best explanation I found so far.