How do I solve javax.net.ssl.SSLHandshakeException on Heroku?

I faced SSLHandshakeException on Heroku.

This app was not SSL app. But this app called a ssl-based web api from inside of the app. Usually, using keytool to adopt SSL cert to JVM solves this kind of problem.

But how do I this on Heroku?

logs here:

    2012-06-12T11:08:08+00:00 app[web.1]: Caused by: sun.security.validator.ValidatorException:  PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:  unable to find valid certification path to requested target
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:324) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.validator.Validator.validate(Validator.java:235) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:230) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]: Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:270) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:197) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:255) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:319) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.validator.Validator.validate(Validator.java:235) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147) ~[na:1.6.0_20]
    2012-06-12T11:08:08+00:00 app[web.1]:   at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:224) ~[na:1.6.0_20]

Answer

When you are making a SSL connection to a server, you should be having the Server's certificate in the client truststore.

You should import the server certificate into a keystore and specify the keystore using javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword.

Check if you have specified these properties. If already specified check if they point to keystore properly.

Advertisement

Answer