title: Apache HTTP Client javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
body: <p>We are developing an application using tomcat and jersey.<br>
  Within this webapplication we need to connect to a <code>https Website</code> with a <code>valid</code>, not expired <code>certificate</code>. 
  If I do connect to this website locally via my chrome browser, everything works fine!
  Unfortunately the tomcat server with our webapp throws an exception. We are using the <code>Apache HttpClient (4.0)</code> to connect to the https site:</p>
  
  <pre><code>javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
  at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:371)
  at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:126)
  at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:572)
  at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
  at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:294)
  at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:645)
  at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:480)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:784)
  </code></pre>
  
  <p>The server certificate is absolutely valid and from <code>thawte</code>. 
  Three different online tools validated the certificate successfully.<br>
  <code>Openssl</code> has an issue, too and showing me three certificates but throwing a simple error:</p>
  
  <pre><code>Verify return code: 20 (unable to get local issuer certificate)
  </code></pre>
  
  <p>The problem with openssl seems to be that it uses the wrong path <code>/usr/lib/ssl</code>instead of <code>/etc/ssl/certs</code>. If I use the CApath argument pointing to the proper path, openssl works fine so may this be an issue with the httpClient?</p>
  
  <p>So our code for the default client is quite simple: </p>
  
  <pre><code>    client = new DefaultHttpClient();
      response = client.execute(url); //this throws the exception
      EntityUtils.consume(response.getEntity());
  </code></pre>
  
  <p>It's not an option to allow any certificates by implementing a custom TrustedManager! 
  Futher I read, that some CA's are not part of the JDK/JRE and so it's certificates should be imported manually into the <code>keystore</code> or use a custom one, but thawte is a well known CA and shouldn't it work on default? </p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I did set the javax.debug properties in catalina.sh so that I have further information about the problem:</p>
  
  <pre><code>http-bio-8080-exec-1, handling exception: javax.net.ssl.SSLHandshakeException: 
  sun.security.validator.ValidatorException: PKIX path validation failed: 
  java.security.cert.CertPathValidatorException: basic constraints check failed: 
  pathLenConstraint violated - this cert must be the last cert in the certification path
  </code></pre>
  
  <p>I would appreciate any help! 
  Thanks in advance!</p>