我知道有很多关于这次ssl握手的问题，我仍然无法弄清楚这一点。 我正在尝试向link提交一个java-ws soap消息，并且终点获得了适当的证书，但是为什么java不会尊重它并给出这个众所周知的异常：
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
当我启用网络调试时，我得到以下信息：
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1460059402 bytes = { 161, 121, 184, 113, 145, 191, 213, 189, 184, 72, 172, 65, 62, 227, 170, 31, 178, 118, 248, 177, 185, 159, 199, 169, 12, 109, 219, 190 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_MD5, TLS_KRB5_WITH_RC4_128_SHA, TLS_KRB5_WITH_RC4_128_MD5, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: demo296.vertexinc.com]
***
http-bio-443-exec-2, WRITE: TLSv1 Handshake, length = 213
http-bio-443-exec-2, READ: TLSv1 Handshake, length = 49
*** ServerHello, TLSv1
RandomCookie: GMT: 1460059402 bytes = { 87, 39, 164, 163, 199, 232, 199, 16, 238, 235, 203, 206, 70, 140, 226, 224, 163, 188, 121, 208, 109, 2, 153, 126, 2, 19, 50, 82 }
Session ID: {}
Cipher Suite: SSL_RSA_WITH_RC4_128_SHA
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
***
%% Initialized: [Session-2, SSL_RSA_WITH_RC4_128_SHA]
** SSL_RSA_WITH_RC4_128_SHA
http-bio-443-exec-2, READ: TLSv1 Handshake, length = 1292
*** Certificate chain
chain [0] = [
[
Version: V3
Subject: CN=*.vertexinc.com, OU=Vertex Inc., O=Vertex Inc, L=Berwyn, ST=Pennsylvania, C=US
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
Key: Sun RSA public key, 2048 bits
modulus: 21011005644752221458440925799952678183823792833716434828539993186933856337574997854121938343987119300440905398000025082799836849602033704013027189447726880355089766117512592061516178819039391085455553102645007112453032938831724998233033633698493476955604784493337783750130439099745399832839029789567413380485885064049847898628887513164667338660464585157036580363609549890856904881728624134009162466528991105337058182437282700845235389976741141724118492275741871053644597590803795354460154631255971959996923189046439657231520344375967087626815565942867567333556795133804268135785335388269336344735453096564729483564909
public exponent: 65537
Validity: [From: Sun Nov 09 19:00:00 EST 2014,
To: Wed Nov 09 18:59:59 EST 2016]
Issuer: CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US
SerialNumber: [ 254cae2c 09b790ad ef6c356f 343deac7]
Certificate Extensions: 8
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: ocsp
accessLocation: URIName: http://gn.symcd.com
,
accessMethod: caIssuers
accessLocation: URIName: http://gn.symcb.com/gn.crt
]
]
[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: D2 6F F7 96 F4 85 3F 72 3C 30 7D 23 DA 85 78 9B .o....?r<0.#..x.
0010: A3 7C 5A 7C ..Z.
]
]
[3]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:false
PathLen: undefined
]
[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName: http://gn.symcb.com/gn.crl]
]]
[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [2.16.840.1.113733.1.7.54]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 33 68 74 74 70 73 3A 2F 2F 77 77 77 2E 67 65 .3https://www.ge
0010: 6F 74 72 75 73 74 2E 63 6F 6D 2F 72 65 73 6F 75 otrust.com/resou
0020: 72 63 65 73 2F 72 65 70 6F 73 69 74 6F 72 79 2F rces/repository/
0030: 6C 65 67 61 6C legal
], PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.2
qualifier: 0000: 30 35 0C 33 68 74 74 70 73 3A 2F 2F 77 77 77 2E 05.3https://www.
0010: 67 65 6F 74 72 75 73 74 2E 63 6F 6D 2F 72 65 73 geotrust.com/res
0020: 6F 75 72 63 65 73 2F 72 65 70 6F 73 69 74 6F 72 ources/repositor
0030: 79 2F 6C 65 67 61 6C y/legal
]] ]
]
[6]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
[7]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Key_Encipherment
]
[8]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: *.vertexinc.com
DNSName: vertexinc.com
]
]
Algorithm: [SHA256withRSA]
Signature:
0000: 8B 63 CB B1 74 E3 15 E8 24 1D C9 31 DF 0B A5 F2 .c..t...$..1....
0010: 04 72 FF 9A CD E0 AD 36 4B E1 C6 2C 02 39 BB C2 .r.....6K..,.9..
0020: CB 8C CE BE 60 EF 59 59 7E 20 47 90 47 9A 10 35 ....`.YY. G.G..5
0030: C4 1C 96 3D 11 7C C0 1D 02 E5 E8 32 FC 2E E8 E5 ...=.......2....
0040: 17 DB 52 70 C1 79 38 1B 9E 4F CF 8E 09 5B 96 EB ..Rp.y8..O...[..
0050: F9 FB DD 66 33 17 53 32 C7 37 AA 1D D1 84 05 D6 ...f3.S2.7......
0060: 53 84 CA AB 5F E7 DB 0E 12 F6 82 A9 24 7A ED 3C S..._.......$z.<
0070: ED CC 5C 77 8D 0B D3 FD FD FA 6A 8B 34 C3 E1 2E ..\w......j.4...
0080: FB D8 31 B9 A1 5C BD 63 FD 66 01 00 69 D2 8A 13 ..1..\.c.f..i...
0090: 99 08 84 66 97 65 93 93 27 B7 70 A0 07 01 4F AD ...f.e..'.p...O.
00A0: 5C B4 BB 79 18 18 50 CD 64 85 38 9E 5C 39 20 FB \..y..P.d.8.\9 .
00B0: A3 C4 97 7C 65 9F 53 ED 25 D3 7A 02 08 BC DB 28 ....e.S.%.z....(
00C0: 09 F1 12 62 D7 9E 21 22 BF 36 B3 66 35 77 1C 6D ...b..!".6.f5w.m
00D0: EE E8 67 F2 49 A9 6A B1 1B B8 70 63 09 19 F2 71 ..g.I.j...pc...q
00E0: 7C BD 6C 70 5B C1 FE 17 1A E4 80 26 55 7F F1 1D ..lp[......&U...
00F0: BF 57 38 D2 34 49 80 13 5B DB 1F 16 C1 A6 A8 82 .W8.4I..[.......
]
***
%% Invalidated: [Session-2, SSL_RSA_WITH_RC4_128_SHA]
http-bio-443-exec-2, SEND TLSv1 ALERT: fatal, description = certificate_unknown
http-bio-443-exec-2, WRITE: TLSv1 Alert, length = 2
http-bio-443-exec-2, called closeSocket()
http-bio-443-exec-2, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
从最后一点可以看出，证书链来自权威。
GeoTrust Global CA是根链，包含在默认的jdk cacerts中。 我在想如果root发行者是受信任的，而在cacerts中，那么java应该尊重它，但事实并非如此。然后第二个cacerts链GeoTrust SSL CA - G3不在那里，我导入它。仍然没有奏效。我可以导入整个证书链，但为什么java在这种情况下不会尊重受信任的权限？
谢谢！
答案 0 :(得分：0)
根据SSLLabs，证书链不完整，需要＆＃34;额外下载＆＃34;。所以我觉得你在导入更多链条的过程中走在了正确的轨道上。
此外，它不支持TLS 1.2 - 事实上，看起来iOS9也没有连接。我知道这不是你的证书，但可能是Java在这里有点挑剔的证书。
