<p>We are using <code>clj-http</code> with a keystore consisting of a keystore.pfx with a self-signed certificate:</p>

<pre><code>(let [url (str url "api/fetch")
      opts {:keystore "keystore.pfx"
            :keystore-type "pkcs12"
            :keystore-pass "****"
            :body (json/encode {:method "yada"})
            :content-type :json
            :throw-entire-message? true
            :async? false}
      response (http/post url opts)]
  (-&gt; response
      :body
      base64-decode))
</code></pre>

<p>The API calls with the keystore works locally to call the API with a client-side cert, but not in a Docker on Kubernetes.</p>

<p>Exception is:</p>

<blockquote>
  <p>sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target </p>
</blockquote>

<p>Any ideas how to fix? Do we need to add it to the JVM some way? If so, where and how to add the pfx?</p>

user2609980
<p>Your self signed client/server certs don't share the chain of trust (this is what the error message is telling you).  </p>

<p>Put the CA cert(s) in a trust store, e.g.</p>

<pre class="lang-sh prettyprint-override"><code>keytool -importcert -noprompt -alias ca -file ca.crt -keystore truststore -storepass secret
</code></pre>

<p>and add the trust store to the request:</p>

<pre class="lang-clj prettyprint-override"><code>  ; ...
  :trust-store "truststore"  ; XXX
  :trust-store-pass "secret" ; XXX
  :keystore "keystore.pfx"
  :keystore-pass "****"
  ; ...
</code></pre>
