Geek Answers Handbook

How to solve javax.net.ssl.SSLHandshakeException on Heroku?

I encountered an SSLHandshakeException on Heroku.

This application was not an SSL application. But this application is called ssl-based web api from inside the application. Usually, using keytool to accept an SSL certificate in the JVM solves this problem.

But how am I doing this on Heroku?

registered here:

  2012-06-12T11:08:08+00:00 app[web.1]: Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:324) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.validator.Validator.validate(Validator.java:235) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:230) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:270) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:197) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:255) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:319) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.validator.Validator.validate(Validator.java:235) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147) ~[na:1.6.0_20] 2012-06-12T11:08:08+00:00 app[web.1]: at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:224) ~[na:1.6.0_20]
+4
source share
3 answers

When you create an SSL connection to a server, you should be having the Server certificate in a client proxy.

You must import the server certificate into a keystore and specify the keystore using javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword .

Check if these properties are specified. If already specified, verify that they point to the keystore correctly.

0
source

I'm not really sure if heroku has any support for updating the keystore, but you can always provide your own keystore as java environment parameters in your configuration or procfile, for example,

 web: java -jar -Djavax.net.ssl.trustStore=path/to/keystore -Djavax.net.ssl.trustStorePassword=changeit --port $PORT target/*.war
+1
source

To fix the SSL certificate verification error (this usually happens with self-signed certificates), you need to add the certificate in java keystore to let the JVM always trust it.

To add it locally:

  • find the keystore file (usually located in jre / lib / security / cacerts)
  • download the certificate .cer file ( here are some ways to do this , I think downloading with Firefox is the easiest)
  • Import the certificate into the keystore: keytool -import -keystore cacerts -file custom.cer

Download the keystore in Heroku adding the cacerts file as a custom JVM file .

0
source

More articles:


All Articles