title: SoapFault: No trusted certs found
body: <p><strong>Intro</strong></p>
  
  <p>I'm working on a feature for an accounting system that takes a XML file containing data about a sale, sends it to a governmental server, and receives a response message. You also need some certificates to ensure authenticity of the senders. I'm using a client from someone else to do all the hard work of encrypting, calling the webservice, handling the certificates, receiving messages back, and so on. I only have to write a simple app to call a function of that client and send it the file, certs, and some arguments.</p>
  
  <p><strong>Error</strong></p>
  
  <p>My app appeared to be working fine when testing on a playground server. When I tried the production server with a production message however(even production messages on production servers aren't treated as actual lawful sales until 1st Dec 2016, they're just starting the thing), the app throws an error, which is extremely weird, since any devs developing a similar app at a later date wouldn't have a chance of discovering this error until they released the app.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>The problem is, the error points to somewhere in the encryption/security libraries of the client. I have never dealt with anything of the sort, so I'm absolutely lost as to where to start looking. On top of that, the error seems to be fairly rare, and the few notes I have found on it are largely irrelevant to my project, or at least that's how they seem to me given my nonexistent understanding of the area.</p>
  
  <p>Below is the stacktrace. If anyone more versed in these libraries could point me to where the fault may be, I would be very grateful. Please ask if you need more info/testing.</p>
  
  <pre><code>    WARNING: Interceptor for {http://fs.mfcr.cz/eet/schema/v3}EETService#{http://fs.mfcr.cz/eet/schema/v3}OdeslaniTrzby has thrown exception, unwinding now
  org.apache.cxf.binding.soap.SoapFault: Error during certificate path validation: No trusted certs found
          at org.apache.cxf.ws.security.wss4j.WSS4JUtils.createSoapFault(WSS4JUtils.java:277)
          at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:333)
          at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:190)
          at cz.tomasdvorak.eet.client.security.SecureEETCommunication$1.handleMessage(SecureEETCommunication.java:135)
          at cz.tomasdvorak.eet.client.security.SecureEETCommunication$1.handleMessage(SecureEETCommunication.java:119)
          at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
          at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:802)
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1673)
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1551)
          at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1348)
          at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:56)
          at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:215)
          at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
          at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:651)
          at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
          at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
          at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:516)
          at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:425)
          at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:326)
          at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:279)
          at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
          at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:138)
          at com.sun.proxy.$Proxy70.odeslaniTrzby(Unknown Source)
          at cz.tomasdvorak.eet.client.EETClientImpl.submitReceipt(EETClientImpl.java:39)
          at cz.tomasdvorak.eetdemo.Main.main(Main.java:134)
  Caused by: org.apache.wss4j.common.ext.WSSecurityException: Error during certificate path validation: No trusted certs found
          at org.apache.wss4j.common.crypto.Merlin.verifyTrust(Merlin.java:877)
          at cz.tomasdvorak.eet.client.security.MerlinWithCRLDistributionPointsExtension.verifyTrust(MerlinWithCRLDistributionPointsExtension.java:34)
          at org.apache.wss4j.dom.validate.SignatureTrustValidator.verifyTrustInCerts(SignatureTrustValidator.java:108)
          at org.apache.wss4j.dom.validate.SignatureTrustValidator.validate(SignatureTrustValidator.java:64)
          at org.apache.wss4j.dom.processor.SignatureProcessor.handleToken(SignatureProcessor.java:185)
          at org.apache.wss4j.dom.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:428)
          at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:278)
          ... 23 more
  </code></pre>