Java 7，Spring Security，在Linux上运行。
我正在开发一个需要使用LDAP over SSL对用户进行身份验证的Java应用程序。我没有在标准位置安装证书，而是在应用程序启动时联系LDAP服务器，下载新证书（使用InstallCert.java），并将其保存到本地文件。我有属性
-Djavax.net.ssl.keyStore=path/to/store
和
-Djavax.net.ssl.keyStorePassword=password
正确定义并指向我保存证书的位置 - 证书有效;我用keytool检查了它。
一段时间内一切正常 - 我可以毫无问题地对用户进行身份验证。但是，经过一段时间（大约30到60秒左右），验证尝试开始失败：
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
我有一个循环证明同一个用户一遍又一遍，所以我每次都可以重现这个问题。
如果我重新启动我的应用程序并下载新证书，一切正常，但过了一段时间后，我开始得到同样的例外。
我很确定我有一个有效的证书：我在启动应用程序之前删除了前一个证书，新的一个出现了，keytool告诉我它是有效的;该程序工作了一段时间，所以我的代码必须正确。我花了整整一天时间在Google上试图找到一些线索，说明为什么会这样，没有运气。
有没有人经历过类似的事情？
使用-Djavax.net.debug=ssl,handshake的应用程序日志：
keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trustStore is: ../resources/secKS
trustStore type is : jks
trustStore provider is :
init truststore
adding as trusted cert:
Subject: <omitted>
Issuer: <omitted>
Algorithm: RSA; Serial number: 0x127b251800020002f2b7
Valid from Sat Mar 01 07:16:28 CST 2014 until Sun Mar 01 07:16:28 CST 2015
trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1387899859 bytes = { 63, 26, 24, 110, 212, 176, 189, 126, 142, 53, 15, 168, 88, 7, 104, 99, 204, 149, 116, 233, 23, 209, 28, 147, 217, 94, 149, 88 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: pc.internal.macquarie.com]
***
Thread-4, WRITE: TLSv1 Handshake, length = 183
Thread-4, READ: TLSv1 Handshake, length = 7214
*** ServerHello, TLSv1
RandomCookie: GMT: 1387899859 bytes = { 43, 203, 90, 227, 241, 108, 250, 97, 218, 162, 229, 10, 242, 201, 102, 172, 244, 127, 1, 159, 112, 85, 64, 200, 127, 176, 209, 88 }
Session ID: {239, 31, 0, 0, 50, 39, 125, 41, 69, 122, 153, 226, 211, 8, 67, 220, 191, 105, 65, 238, 228, 237, 177, 199, 140, 18, 237, 199, 169, 242, 23, 209}
Cipher Suite: SSL_RSA_WITH_RC4_128_MD5
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
***
%% Initialized: [Session-2, SSL_RSA_WITH_RC4_128_MD5]
** SSL_RSA_WITH_RC4_128_MD5
*** Certificate chain
chain [0] = [
[
Version: V3
Subject: CN=<omitted>
Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
Key: Sun RSA public key, 1024 bits
modulus: 128480787328905034341484558614507757088759660031698956680126704737026971009098243483416647680153867037389802340068271646449681090771848694755692150570797149041184892936137394715909937404525650963377213859810628284412870136267487017282593188331276449067115775494714024533885156245603504553374357102100301531921
public exponent: 65537
Validity: [From: Sat Mar 01 06:40:31 CST 2014,
To: Sun Mar 01 06:40:31 CST 2015]
Issuer: CN=<omitted>
SerialNumber: [ 125a3b12 00020002 f2b2]
Certificate Extensions: 10
[1]: ObjectId: 1.3.6.1.4.1.311.21.10 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 28 30 26 30 0C 06 0A 2B 06 01 04 01 82 37 14 .(0&0...+.....7.
0010: 02 02 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0A ..0...+.......0.
0020: 06 08 2B 06 01 05 05 07 03 02 ..+.......
[2]: ObjectId: 1.3.6.1.4.1.311.21.7 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 2F 30 2D 06 25 2B 06 01 04 01 82 37 15 08 BD ./0-.%+.....7...
0010: C1 4E 81 81 8D 71 84 91 9B 29 85 8F A0 6C 83 C6 .N...q...)...l..
0020: 9E 71 40 82 EF 96 27 82 9F 92 25 02 01 67 02 01 .q@...'...%..g..
0030: 00 .
[3]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: caIssuers
accessLocation: URIName: ldap:///<omitted>cACertificate?base?objectClass=certificationAuthority
,
accessMethod: caIssuers
accessLocation: URIName: http://<omitted>
,
accessMethod: caIssuers
accessLocation: URIName: http://<omitted>
,
accessMethod: ocsp
accessLocation: URIName: http://<omitted>
]
]
[4]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: CE 94 DC 6E 73 C2 80 92 13 F2 A1 47 D6 77 42 C4 ...ns......G.wB.
0010: 39 B0 B8 F4 9...
]
]
[5]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName: ldap:///<omited,, URIName: http://<omitted>, URIName: <omitted>]
]]
[6]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [1.3.6.1.4.1.311.21.8.1007822.2115313.8670633.10735724.7442289.64.1.402]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 2C 68 74 74 70 3A 2F 2F 70 6B 69 64 70 31 2E .,http://pkidp1.
<omitted>
]] ]
]
[7]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
1.3.6.1.4.1.311.20.2.2
serverAuth
clientAuth
]
[8]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
DigitalSignature
Key_Encipherment
]
[9]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: <omitted>
]
[10]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 5C E5 8F AB 06 7C 50 BD D7 91 69 34 48 8C D2 0E \.....P...i4H...
0010: 2A D6 5E 20 *.^
]
]
]
Algorithm: [SHA1withRSA]
Signature:
0000: 54 EB FB 2B 36 D5 23 29 66 09 74 80 DE 94 26 42 T..+6.#)f.t...&B
0010: F3 26 99 D9 BA 5F BC FE 65 F3 5B C5 C1 5F 18 78 .&..._..e.[.._.x
0020: 19 E1 FE 2C 8C 97 66 54 05 D8 A9 B6 FC 41 31 80 ...,..fT.....A1.
0030: 0B EB 39 44 BF 88 C7 8E 3F 6F AB 27 E0 EF C5 C0 ..9D....?o.'....
0040: F5 3F B3 53 56 22 2F 94 51 73 6D 01 31 E5 0C 24 .?.SV"/.Qsm.1..$
0050: C7 35 6D 8C 63 5F 10 BB 42 11 EB 39 D0 92 3B 27 .5m.c_..B..9..;'
0060: 42 DB CB 41 F4 8A F1 D7 25 44 A7 DE 11 B8 E5 EB B..A....%D......
0070: 29 6D 75 61 09 F5 BE 2F D1 4D 91 78 C8 9C 34 73 )mua.../.M.x..4s
0080: B8 B6 D4 64 CC 64 4C 50 12 0C A5 5C 66 66 94 DE ...d.dLP...\ff..
0090: C3 09 BA 75 F5 DE B2 22 73 09 F0 F6 6D 64 25 2F ...u..."s...md%/
00A0: FB 33 C6 3A C3 8E F2 96 D8 13 EA BD 40 10 50 A8 .3.:........@.P.
00B0: 7B BE 8F 48 43 9A 80 85 A8 5A DB 25 64 B4 5F A1 ...HC....Z.%d._.
00C0: 15 DD 71 AB 20 8C 3F 36 67 7D A0 D5 09 73 02 6C ..q. .?6g....s.l
00D0: 1C 69 DE 2E A0 07 1C 96 49 71 E8 9A 15 93 0D A0 .i......Iq......
00E0: 27 FC 73 0F 53 17 8B C3 E6 AC 1A 39 15 A2 CC 83 '.s.S......9....
00F0: CE 1F 7D 79 D5 CF BE DD 85 1A 64 1B EF F9 41 9E ...y......d...A.
]
chain [1] = [
[
Version: V3
Subject: CN=<omitted>
Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
Key: Sun RSA public key, 2048 bits
modulus: 22359192553251616882525512914135207862945316850625026509586220104340455864279327000337629161502114363440487498639724175623567951470270794891768252994144317953686898150451581587331248901162533312932905859809140387248649026857190124469942099318196674743474482499088660217974341345944208179433864168172021412841174101665154974669658170086712373136041250932220633357002927590609385993765726852902828352147267966342020529750696982039607593091983184202136548479526185053237959817275435129563865352944485076789990784360767974182750619019222278262960413441606680606770005561065163487771275176732178246055288446333467601387131
public exponent: 65537
Validity: [From: Wed Aug 30 03:42:29 CDT 2006,
To: Tue Aug 30 03:52:29 CDT 2016]
Issuer: CN=<omitted>
SerialNumber: [ 61ff4ed3 00020000 000a]
Certificate Extensions: 9
[1]: ObjectId: 1.3.6.1.4.1.311.20.2 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 0C 1E 0A 00 53 00 75 00 62 00 43 00 41 .....S.u.b.C.A
[2]: ObjectId: 1.3.6.1.4.1.311.21.1 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 05 02 03 02 00 02 .......
[3]: ObjectId: 1.3.6.1.4.1.311.21.2 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 16 04 14 1E D8 DF 73 2F D9 42 5A 95 2D 90 10 .......s/.BZ.-..
0010: FF 8F 8F C1 1E 68 74 29 .....ht)
[4]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 01 4B 94 26 22 E6 F5 D0 92 7F 4B 79 9D 9F A6 8D .K.&".....Ky....
0010: BE 70 65 F8 .pe.
]
]
[5]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:2147483647
]
[6]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName: <omitted>, URIName: <omitted>, URIName: <omitted>]
]]
[7]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [1.3.6.1.4.1.311.21.8.1007822.2115313.8670633.10735724.7442289.64.1.402]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: <omitted>
]] ]
]
[8]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
DigitalSignature
Key_CertSign
Crl_Sign
]
[9]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: CE 94 DC 6E 73 C2 80 92 13 F2 A1 47 D6 77 42 C4 ...ns......G.wB.
0010: 39 B0 B8 F4 9...
]
]
]
Algorithm: [SHA1withRSA]
Signature:
0000: 75 C2 37 CE AD 22 7A B2 82 AA 70 4C 0D 00 4C 36 u.7.."z...pL..L6
0010: 16 A5 CF AE 46 62 F8 46 87 68 B4 02 EA 2D 57 DD ....Fb.F.h...-W.
0020: F9 BA 80 AA 86 55 9D 0C 80 8B 32 A2 E6 91 81 29 .....U....2....)
0030: 17 63 DF 93 A1 E8 B8 BE D1 7C E9 09 FD C3 89 F2 .c..............
0040: F5 C3 59 A7 61 EA FE 79 6F BD E1 4B DC 53 14 18 ..Y.a..yo..K.S..
0050: 2B F0 37 95 06 D1 83 86 8F 4B 91 54 66 57 49 5E +.7......K.TfWI^
0060: 87 D6 56 42 AC E2 AB 65 05 AB 8E 17 5A DD 82 15 ..VB...e....Z...
0070: 7D 41 4B 1D 17 EC 27 6B 5D 9F 90 5D FD A3 9F 89 .AK...'k]..]....
0080: 82 95 04 4A 7C E6 F8 97 BA DC 7C 29 6C F4 96 62 ...J.......)l..b
0090: 61 52 61 CD 30 E4 A3 2D B9 CE 91 80 66 98 D7 82 aRa.0..-....f...
00A0: D0 96 B1 CB 01 DB 80 21 63 F1 3F 6D 80 5A 07 FC .......!c.?m.Z..
00B0: 97 BF A5 50 AA AA 30 9A 02 2C 6A 06 EC D4 C0 C5 ...P..0..,j.....
00C0: D3 35 EE 62 E1 FA 9D 3E 08 27 AA FB D8 A9 1D B9 .5.b...>.'......
00D0: 7B A9 4D 90 D8 BD CA 2D 62 8E 87 76 FD FF 9F 6E ..M....-b..v...n
00E0: 5C 18 45 7F 9E 8E 75 99 D3 AC 03 50 64 D3 6E B6 \.E...u....Pd.n.
00F0: 97 03 50 0D D6 1E 7F B6 BE 4B 16 07 CE C1 A8 77 ..P......K.....w
]
***
%% Invalidated: [Session-2, SSL_RSA_WITH_RC4_128_MD5]
Thread-4, SEND TLSv1 ALERT: fatal, description = certificate_unknown
Thread-4, WRITE: TLSv1 Alert, length = 2
Thread-4, called closeSocket()
Thread-4, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
pool-1-thread-2, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
09:21:07.904 [pool-1-thread-2] ERROR c.m.c.s.c.CachingSecurityServiceImplementation .- Exception thrown while authenticating user [aantena2]
09:21:07.911 [pool-1-thread-2] ERROR c.m.c.s.handlers.SecurityHandler .- Error executing request
....SecurityServiceException: Exception thrown while authenticating user [...]
Caused by: org.springframework.ldap.CommunicationException: simple bind failed: pc.internal.macquarie.com:636; nested exception is javax.naming.CommunicationException: simple bind failed: pc.internal.macquarie.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:100) ~[spring-ldap-core-1.3.2.RELEASE.jar:1.3.2.RELEASE]
at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.bindAsUser(ActiveDirectoryLdapAuthenticationProvider.java:187) ~[spring-security-ldap-3.2.3.RELEASE.jar:3.2.3.RELEASE]
at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.doAuthentication(ActiveDirectoryLdapAuthenticationProvider.java:127) ~[spring-security-ldap-3.2.3.RELEASE.jar:3.2.3.RELEASE]
at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:80) ~[spring-security-ldap-3.2.3.RELEASE.jar:3.2.3.RELEASE]
at com.macquarie.cmd.security.cache.CachingSecurityServiceImplementation.getUser(CachingSecurityServiceImplementation.java:201) ~[security-server-0.4-SNAPSHOT.jar:na]
... 12 common frames omitted
Caused by: javax.naming.CommunicationException: simple bind failed: pc.internal.macquarie.com:636
at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154) ~[na:1.7.0_40]
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84) ~[na:1.7.0_40]
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684) ~[na:1.7.0_40]
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307) ~[na:1.7.0_40]
at javax.naming.InitialContext.init(InitialContext.java:242) ~[na:1.7.0_40]
at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:153) ~[na:1.7.0_40]
at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider$ContextFactory.createContext(ActiveDirectoryLdapAuthenticationProvider.java:347) ~[spring-security-ldap-3.2.3.RELEASE.jar:3.2.3.RELEASE]
at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.bindAsUser(ActiveDirectoryLdapAuthenticationProvider.java:181) ~[spring-security-ldap-3.2.3.RELEASE.jar:3.2.3.RELEASE]
... 15 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.7.0_40]
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1884) ~[na:1.7.0_40]
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276) ~[na:1.7.0_40]
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270) ~[na:1.7.0_40]
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1341) ~[na:1.7.0_40]
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153) ~[na:1.7.0_40]
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868) ~[na:1.7.0_40]
at sun.security.ssl.Handshaker.process_record(Handshaker.java:804) ~[na:1.7.0_40]
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016) ~[na:1.7.0_40]
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312) ~[na:1.7.0_40]
at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:882) ~[na:1.7.0_40]
at sun.security.ssl.AppInputStream.read(AppInputStream.java:102) ~[na:1.7.0_40]
at java.io.BufferedInputStream.fill(BufferedInputStream.java:235) ~[na:1.7.0_40]
at java.io.BufferedInputStream.read1(BufferedInputStream.java:275) ~[na:1.7.0_40]
at java.io.BufferedInputStream.read(BufferedInputStream.java:334) ~[na:1.7.0_40]
at com.sun.jndi.ldap.Connection.run(Connection.java:853) ~[na:1.7.0_40]
... 1 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385) ~[na:1.7.0_40]
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) ~[na:1.7.0_40]
at sun.security.validator.Validator.validate(Validator.java:260) ~[na:1.7.0_40]
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326) ~[na:1.7.0_40]
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231) ~[na:1.7.0_40]
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126) ~[na:1.7.0_40]
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1323) ~[na:1.7.0_40]
... 12 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196) ~[na:1.7.0_40]
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268) ~[na:1.7.0_40]
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380) ~[na:1.7.0_40]
... 18 common frames omitted
答案 0 :(得分：0)
所以我弄清楚出了什么问题 - 我们的LDAP安装实际上是负载平衡的;当我启动我的应用程序时，我从其中一个服务器获得了一个证书，但是下次我尝试对用户进行身份验证时，我无法保证我会访问同一个服务器。
这解释了为什么它可以工作一段时间，因此如果您遇到随机SSL错误，请确保您没有遇到负载均衡的LDAP。