"sun.security.validator.ValidatorException: PKIX path building failed: Exception: unable to find valid certification path to requested target"

Question

我正在尝试获取此站点“https://www.ssfcu.org/en-us/Pages/default.aspx”的响应代码。代码片段是：

try{
     HttpURLConnection connection = pingUrl(location);
     responseCode = connection.getResponseCode();
}catch(Exception e) {
}

public HttpURLConnection pingUrl(String url) throws Exception{

    int count = 0;
    HttpURLConnection conn = null;

    conn = (HttpURLConnection) new URL(url).openConnection();
    conn.setRequestMethod("GET");
    conn.setConnectTimeout(2000);
    conn.setInstanceFollowRedirects(false);
    conn.setReadTimeout(10000);
    conn.connect();
    Thread.sleep(1000);

    return conn;
}

但我遇到了一个例外：

sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

我该如何解决这个问题？

Answer 1

旧的 COMODO 根证书已于 5 月 30 日过期。

https://www.reddit.com/r/linux/comments/gshh70/sectigo_root_ca_expiring_may_not_be_handled_well/

https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020

不知道这是否会影响 www.ssfcu.org，但您可以尝试将更新的证书导入到您的 java 密钥库：

获取 https://crt.sh/?d=1720081 和 https://crt.sh/?d=1199354
将crt文件转换为der文件：openssl x509 -in 1720081.crt -outform der -out 1720081.der
keytool -import -file 1720081.der -keystore your-keystore -alias Comodo（或 1199354 的别名 UserTrust）

您的密钥库位于文件 lib/security/cacerts 中的 JRE_HOME 目录中。您需要 root 权限才能编辑 cacerts 文件。

编辑：我仔细看了看，发现 Comodo 并未包含在 www.sfcu.org 的证书链中，但只要您可以识别已过期的根证书或中间证书，上述说明就是正确的。我们今天巧合运行遇到了 linkedin.com 的问题。与 www.ssfcu.org 一样，他们也使用来自 DigiCert 的证书链，所以也许他们最近也有一些证书过期了。

"sun.security.validator.ValidatorException: PKIX path building failed: Exception: unable to find valid certification path to requested target"

"sun.security.validator.ValidatorException: PKIX path building failed: Exception: unable to find valid certification path to requested target"

httpurlconnection

pkix