Use InstallCert

最新推荐文章于 2024-12-16 11:36:15 发布
原创 最新推荐文章于 2024-12-16 11:36:15 发布 · 517 阅读 · 0 ·
CC 4.0 BY-SA版权
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
文章标签：

#java

本文介绍如何使用InstallCert.java程序安装自签名证书到Java的信任库中。通过编译并运行该程序，可以将指定网站的证书添加到Java的信任库中，从而避免HTTPS连接时的信任问题。
编译InstallCert.java，然后执行：java InstallCert hostname，比如：
java InstallCert www.twitter.com
会看到如下信息：
java InstallCert www.twitter.com
Loading KeyStore /usr/java/jdk1.6.0_16/jre/lib/security/cacerts...
Opening connection to www.twitter.com:443...
Starting SSL handshake...

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1476)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:846)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:815)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1025)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1038)
at InstallCert.main(InstallCert.java:63)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:221)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:145)
at sun.security.validator.Validator.validate(Validator.java:203)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:172)
at InstallCert$SavingTrustManager.checkServerTrusted(InstallCert.java:158)
at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLContextImpl.java:320)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:839)
... 7 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:236)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:194)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:216)
... 13 more

Server sent 2 certificate(s):

1 Subject CN=www.twitter.com, O=example.com, C=US
Issuer CN=Certificate Shack, O=example.com, C=US
sha1 2e 7f 76 9b 52 91 09 2e 5d 8f 6b 61 39 2d 5e 06 e4 d8 e9 c7
md5 dd d1 a8 03 d7 6c 4b 11 a7 3d 74 28 89 d0 67 54

2 Subject CN=Certificate Shack, O=example.com, C=US
Issuer CN=Certificate Shack, O=example.com, C=US
sha1 fb 58 a7 03 c4 4e 3b 0e e3 2c 40 2f 87 64 13 4d df e1 a1 a6
md5 72 a0 95 43 7e 41 88 18 ae 2f 6d 98 01 2c 89 68

Enter certificate to add to trusted keystore or 'q' to quit: [1]

输入1，回车，然后会在当前的目录下产生一个名为“ssecacerts”的证书。
将证书拷贝到$JAVA_HOME/jre/lib/security目录下，或者通过以下方式：
System.setProperty("javax.net.ssl.trustStore", "你的jssecacerts证书路径");


注意：因为是静态加载，所以要重新启动你的Web Server，证书才能生效。
seafront12
关注
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certific
随便乱写
04-11 2665
具体情况是: Java 应用程序(客户端)在尝试访问 api.openai.com(服务器端)时,发现服务器端使用的 SSL/TLS 证书无法被客户端信任。之前通过api调用chatgpt正常的，今天偶然看到好像不能用了，然后可能是最近gpt开通了无密码方式也可以使用，然后导致环境出现了问题。客户端(你的 Java 应用程序)无法验证服务器端证书的合法性,于是 SSL/TLS 握手失败,导致了这个异常。
阿里云 Maven sun.security.provider.certpath.SunCertPathBuilderException
qq_37466640的博客
04-19 637
这个问题困扰了我好久好久，我想碰到这个问题的人都跟我一样的感受：蛋疼。。。。 如图： 之前我也看到过很多的解决办法，基本上两种方案： 在Idea的File -->settings中，设置MavenRunner参数，忽略证书检查即可。 导入参数： -Dmaven.multiModuleProjectDirectory=$MAVEN_HOME -Dmaven.w...
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification 异常总结
XIAOYANJIANJIAN的专栏
10-27 1万+
ERROR] Failed to execute goal on project esNewsServer: Could not resolve dependencies for project com.esNewsTest:esNewsServer:jar:0.0.1-SNAPSHOT: Failed to collect dependencies at javax.xml.bind:jaxb-...
sun.security.provider .certpath.suncertpathBuilderException: unable to find valid certification path
//
12-16 3170
【代码】sun.security.provider .certpath.suncertpathBuilderException: unable to find valid certification path。
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path
星陨LHF的博客
10-28 3827
Java: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 证书有问题： 解决方案： 获取目标机器需要配置的证书文件 1、编译安装证书的程序文件 javac InstallCert.java import ...
[root@yfw ~]# cd /etc/prosody/conf.d [root@yfw conf.d]# fwrite(STDOUT, $result ? "Y\n" : "N\n"); -bash: syntax error near unexpected token `STDOUT,' [root@yfw conf.d]# echo "auth:testuser:szrengjing.com:password" | /usr/bin/php /www/wwwroot/szrengjing.com/auth_prosody.php PHP: syntax error, unexpected '(' in /www/server/php/56/etc/php-cli.ini on line 883 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/modulename.extension' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/modulename.extension: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.dll' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.dll: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.so' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/path/to/extension/msql.so' - /path/to/extension/msql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Parse error: syntax error, unexpected '?' in /www/wwwroot/szrengjing.com/auth_prosody.php on line 55 [root@yfw conf.d]# /usr/bin/php -v PHP: syntax error, unexpected '(' in /www/server/php/56/etc/php-cli.ini on line 883 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/modulename.extension' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/modulename.extension: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.dll' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.dll: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.so' - /www/server/php/56/lib/php/extensions/no-debug-non-zts-20131226/msql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/path/to/extension/msql.so' - /path/to/extension/msql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP 5.6.40 (cli) (built: May 12 2020 15:27:05) Copyright (c) 1997-2016 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies [root@yfw conf.d]# # 示例：使用 acme.sh 获取证书 [root@yfw conf.d]# ~/.acme.sh/acme.sh --issue -d szrengjing.com --webroot /www/wwwroot/szrengjing.com -bash: /root/.acme.sh/acme.sh: No such file or directory [root@yfw conf.d]# [root@yfw conf.d]# # 安装到 Prosody 目录 [root@yfw conf.d]# ~/.acme.sh/acme.sh --installcert -d szrengjing.com \ > --key-file /etc/prosody/certs/szrengjing.com.key \ > --cert-file /etc/prosody/certs/szrengjing.com.crt -bash: /root/.acme.sh/acme.sh: No such file or directory [root@yfw conf.d]# prosodyctl restart ERROR: Use of 'prosodyctl restart' is disabled in this installation because we detected that this system uses systemd for managing services. To avoid problems, use that directly instead. For example: systemctl restart prosody Proceeding to use prosodyctl may cause process management issues. You can pass --force to override this warning, or set prosodyctl_service_warnings = false in your global config. [root@yfw conf.d]# tail -f /var/log/prosody/prosody.log Nov 11 15:55:04 c2s55f125d5f630 info Client connected Nov 11 15:55:04 c2s55f125d5f630 info Client disconnected: connection closed Nov 11 15:55:05 c2s55f125d1d190 info Client connected Nov 11 15:55:05 c2s55f125d1d190 info Client disconnected: connection closed Nov 11 15:55:05 c2s55f125daa370 info Client connected Nov 11 15:55:05 c2s55f125daa370 info Client disconnected: connection closed Nov 11 16:29:53 mod_cron info Running periodic tasks Nov 11 17:11:32 s2sin55f125aac770 info Incoming s2s stream (unknown host)->(unknown host) closed: not-well-formed Nov 11 17:11:36 s2sin55f125af4210 info Incoming s2s stream (unknown host)->(unknown host) closed: not-well-formed Nov 11 17:29:53 mod_cron info Running periodic tasks
最新发布
11-12
~/.acme.sh/acme.sh --installcert -d szrengjing.com \ --key-file /etc/prosody/certs/szrengjing.com.key \ --cert-file /etc/prosody/certs/szrengjing.com.crt ``` ✅ 完成后，Prosody 的 SSL 配置就能生效...
root@lavm-1jdi3tufk3:~# curl https://get.acme.sh | sh % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1032 0 1032 0 0 1442 0 --:--:-- --:--:-- --:--:-- 1441 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 221k 100 221k 0 0 46556 0 0:00:04 0:00:04 --:--:-- 60926 [Wed Jul 16 09:25:49 AM CST 2025] Installing from online archive. [Wed Jul 16 09:25:49 AM CST 2025] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz [Wed Jul 16 09:25:51 AM CST 2025] Extracting master.tar.gz [Wed Jul 16 09:25:51 AM CST 2025] Installing to /root/.acme.sh [Wed Jul 16 09:25:51 AM CST 2025] Installed to /root/.acme.sh/acme.sh [Wed Jul 16 09:25:51 AM CST 2025] Installing alias to '/root/.bashrc' [Wed Jul 16 09:25:51 AM CST 2025] Close and reopen your terminal to start using acme.sh [Wed Jul 16 09:25:51 AM CST 2025] Installing cron job [Wed Jul 16 09:25:51 AM CST 2025] bash has been found. Changing the shebang to use bash as preferred. [Wed Jul 16 09:25:52 AM CST 2025] OK [Wed Jul 16 09:25:52 AM CST 2025] Install success! root@lavm-1jdi3tufk3:~# ~/.acme.sh/acme.sh --issue -d x.115organizatio.dpdns.org --webroot /var/www/html [Wed Jul 16 09:26:15 AM CST 2025] Using CA: https://acme.zerossl.com/v2/DV90 [Wed Jul 16 09:26:15 AM CST 2025] Account key creation OK. [Wed Jul 16 09:26:15 AM CST 2025] No EAB credentials found for ZeroSSL, let's obtain them [Wed Jul 16 09:26:15 AM CST 2025] acme.sh is using ZeroSSL as default CA now. [Wed Jul 16 09:26:15 AM CST 2025] Please update your account with an email address first. [Wed Jul 16 09:26:15 AM CST 2025] acme.sh --register-account -m my@example.com [Wed Jul 16 09:26:15 AM CST 2025] See: https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA [Wed Jul 16 09:26:15 AM CST 2025] Please add '--debug' or '--log' to see more information. [Wed Jul 16 09:26:15 AM CST 2025] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh root@lavm-1jdi3tufk3:~# ~/.acme.sh/acme.sh --installcert -d x.115organizatio.dpdns.org \ --keypath /root/x.115organizatio.dpdns.org.key \ --fullchainpath /root/x.115organizatio.dpdns.org.crt [Wed Jul 16 09:26:37 AM CST 2025] Unknown parameter:
07-17
~/.acme.sh/acme.sh --installcert -d x.115organizatio.dpdns.org \ --keypath /root/x.115organizatio.dpdns.org.key \ --fullchainpath /root/x.115organizatio.dpdns.org.crt ``` 但出现错误： ``` Unknown ...
acme部署https证书
Mr Qiang
03-12 2498
介绍 这里介绍 Let’s Encrypt 机构颁发的证书。 相关资料 Let’s Encrypt 官网：https://letsencrypt.org/zh-cn/getting-started/ acme.sh 教程：https://github.com/acmesh-official/acme.sh/wiki/%E8%AF%B4%E6%98%8E 安装 acme.sh curl http...
1 actionable task: 1 up-to-date bdlf@bdlf-desktop:~/AndroidUSBClient$ rm -rf ~/.gradle/caches/ bdlf@bdlf-desktop:~/AndroidUSBClient$ ./gradlew assembleDebug This version only understands SDK XML versions up to 3 but an SDK XML file of version 4 was encountered. This can happen if you use versions of Android Studio and the command-line tools that were released at different times. IOException: https://dl.google.com/android/repository/addons_list-5.xml javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed IOException: https://dl.google.com/android/repository/addons_list-4.xml javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed IOException: https://dl.google.com/android/repository/addons_list-3.xml javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed IOException: https://dl.google.com/android/repository/addons_list-2.xml javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed IOException: https://dl.google.com/android/repository/addons_list-1.xml javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed Failed to download any source lists! IO exception while downloading manifest: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321) 如何解决？
05-20
如果没有现成的证书文件，可使用工具如 `InstallCert.java` 动态捕获并导入[^3]。 --- ##### 方法三：禁用 HTTPS 验证（仅限开发环境） 虽然不推荐，但在某些情况下可以通过禁用 SSL 验证来快速解决问题。可在 `...
Spark提交到k8s解决问题记录
卧龙居
04-02 1680
1.报错debian InRelease is not valid yet (invalid for another 2d 9h 30min 9s) 检查机器时间是不是没有同步，将时间配置为最新的时间。 2.PKIX path building failed jdk证书问题。需要： /* * Copyright 2006 Sun Microsystems, Inc. All Rights Reserved. * * Redistribution and use in source a
springboot PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException：
只会hello world的小白啊
07-14 2333
驱动程序无法通过使用安全套接字层(SSL)加密与 SQL Server 建立安全连接。
Springboot报错：PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException
qq_35155680的博客
09-09 2764
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target minio报错问题解决
解决 sun.security.provider.certpath.SunCertPathBuilderException
热门推荐
追求自由的码砖人
02-25 4万+
在java调用https 时经常出现：unable to find valid certification path to requested target  ，就是安全java自带的安全证书不受信任，有两种方式可以解决，一种是在代码里面实现：详情请参考：http://mengyang.iteye.com/blog/575671 ，另外就是可以使用手动导入安全证书的方式解决问题。  步骤如下：
maven/springboot项目创建后报 sun.security.provider.certpath.SunCertPathBuilderException
qq_43228403的博客
12-28 1053
创建springboot项目后 pom.xml文件报错。无法下载引入的jar包 经过网上的不断查找（改配置文件，信任证书，跳过ssl证书验证等）方法都试过了，报了下面的几个错误。最后通过修改Maven的settings.xml文件才解决。settings.xml在最后ctrl a 全选覆盖即可 （注意修改localRepository为自己电脑的jar包下载路径）。（修改前注意备份） 错误1： Failure to transfer org.springframework.boot:spring-boot-
解决异常：sun.security.provider.certpath.SunCertPathBuilderException
FourAu的博客
02-13 1699
System.setProperty(“javax.Net.ssl.trustStore”, “你的jssecacerts证书路径”);如果不想修改就直接 在运行的时候 java InstallCert xxx (xxx是你所需要调用的接口的域名或者IP)修改代码块你们的域名网址进行编译 javac InstallCert.java。注意：因为是静态加载，所以要重新启动你的Web Server，证书才能生效。然后会在当前的目录下产生一个名为“ssecacerts”的证书。
【问题记录】Java服务发起HTTPS请求报错sun.security.provider.certpath.SunCertPathBuilderException
拾级而上
09-28 1535
问题报错 今天上线了我开发的一个OAuth2单点登录客户端的实现，在测试系统验证没问题，到生产环境由于单点登录服务端HTTPS协议，报错如下： I/O error on POST request for "xxx.xxx.xxx.xxx:8080": sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException
知其然知其所以然
12-05 2万+
自己搭建的邮件服务器 + 自签的SSL证书，通过代码调用时是不受jdk是信任的。 CA比较新或自行颁发的证书，需要将证书加入到jdk的信任证书库中， 把该证书导入java中的cacerts证书库里 Jdk的安装目录 C:\Program Files\Java\jdk1.8.0\jre\lib\security 执行系统命令： 1、进入安装目录 cd C:\Program Files\J...
UseCase2.0：扩展用例驱动开发
"UseCase2.0 PPT - 用例驱动开发" UseCase2.0是一种升级版的需求获取和软件开发方法，由Dr. Ivar Jacobson与Ian Spence共同提出，旨在解决敏捷项目中的扩展性和适应性问题。这个概念不仅关注于传统的用例技术，还...
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
表情包 代码片
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值