Question

我正在创建AWS Lambda，它将使用来自私有队列（客户端服务器中）中的数据。它需要添加一些受信任的证书。在本地，我执行了以下命令：

keytool -import -v -trustcacerts -alias "clientcert" -file "..\client.cer" -keystore cacerts -keypass changeit -storepass changeit

工作正常。现在，我已将lambda函数上传到aws控制台，出现如下相同错误：

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

有人可以建议我如何在控制台中向AWS Lambda添加可信证书

Answer 1

您也以编程方式创建了信任库请参阅以下代码以供参考

        // Declare path of trust store and create file
        String trustStorePath = "/tmp/trust";
        // try creating above directory and path if you get error no such file 

        // Create Truststore using Key store api
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

        // locate the default truststore
        String filename = System.getProperty("java.home")
                + "/lib/security/cacerts".replace('/', File.separatorChar);

        try (FileInputStream fis = new FileInputStream(filename)) {

            keyStore.load(fis, "changeit".toCharArray());
        }

        // Add Certificate to Key store
        CertificateFactory certF = CertificateFactory.getInstance("X.509");
        Certificate cert = certF.generateCertificate(new FileInputStream("your certificate path"));
        keyStore.setCertificateEntry("any alias", cert);

        // Write Key Store
        try (FileOutputStream out = new FileOutputStream(trustStoreFile)) {
            keyStore.store(out, "changeit".toCharArray());
        }

        // Set Certificates to System properties
        System.setProperty("javax.net.ssl.trustStore", trustStorePath);
        System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

您也可以在 aws lambda 上进行本地测试。希望这能解决问题

如何解决AWS Lambda中的PKIX路径构建失败

1 个答案: