title: Intermittent - SunCertPathBuilderException: unable to find valid certification path to requested target
body: <p>I wrote a java client to connect to Ldap over ssl.
  I imported CA certificates to my java key store and I am able to connect Ldap over ssl and pull information. The problem is it is not working always. Often it throws:CommunicationException:sun.security.validator.ValidatorException: PKIX path building failed. If I re run again (with out changing anything) it works.</p>
  
  <p>This issue killing me for days, as a work around I am catching this exception and retrying. But I am looking for a permanent fix. Any help would be greatly appreciated.</p>
  
  <p>Below is the code where I get the context:</p>
  
  <pre><code>Hashtable&lt;String, String&gt; env = new Hashtable&lt;String, String&gt;();
          env.put(Context.INITIAL_CONTEXT_FACTORY,
                  "com.sun.jndi.ldap.LdapCtxFactory");
          env.put(Context.SECURITY_AUTHENTICATION, "simple");
          env.put(Context.SECURITY_PRINCIPAL, securityPrincipal);
          env.put(Context.PROVIDER_URL, url);
  env.put(Context.SECURITY_CREDENTIALS, securityCredential);
          env.put("java.naming.provider.url", url);
          return new InitialLdapContext(env, null);
  </code></pre>
  
  <p>Strack Trace:</p>
  
  <pre><code>javax.naming.CommunicationException: simple bind failed: adapps.nms.comm:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
          at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:215)
          at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2685)
          at com.sun.jndi.ldap.LdapCtx.&lt;init&gt;(LdapCtx.java:306)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
          at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
          at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
          at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
          at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
          at javax.naming.InitialContext.init(InitialContext.java:240)
          at javax.naming.ldap.InitialLdapContext.&lt;init&gt;(InitialLdapContext.java:151)
          at NMSLdapServiceDAOImpl.getLdapContext(NMSLdapServiceDAOImpl.java:149)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:97)
          at NMSLdapServiceDAOImpl.main(NMSLdapServiceDAOImpl.java:287)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:616)
          at org.eclipse.jdt.internal.jarinjarloader.JarRsrcLoader.main(JarRsrcLoader.java:58)
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1682)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:257)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:251)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1168)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:609)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:545)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:930)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1175)
          at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:805)
          at sun.security.ssl.AppInputStream.read(AppInputStream.java:94)
          at java.io.BufferedInputStream.fill(BufferedInputStream.java:235)
          at java.io.BufferedInputStream.read1(BufferedInputStream.java:275)
          at java.io.BufferedInputStream.read(BufferedInputStream.java:334)
          at com.sun.jndi.ldap.Connection.run(Connection.java:820)
          at java.lang.Thread.run(Thread.java:679)
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:324)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:224)
          at sun.security.validator.Validator.validate(Validator.java:235)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:230)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:270)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1147)
          ... 12 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:197)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:255)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:319)
          ... 18 more
  CommunicationException:sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  javax.naming.CommunicationException: simple bind failed: adapps.nms.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
          at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:215)
          at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2685)
          at com.sun.jndi.ldap.LdapCtx.&lt;init&gt;(LdapCtx.java:306)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
          at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
          at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
          at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
          at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
          at javax.naming.InitialContext.init(InitialContext.java:240)
          at javax.naming.ldap.InitialLdapContext.&lt;init&gt;(InitialLdapContext.java:151)
          at NMSLdapServiceDAOImpl.getLdapContext(NMSLdapServiceDAOImpl.java:149)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:97)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:109)
          at NMSLdapServiceDAOImpl.main(NMSLdapServiceDAOImpl.java:287)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:616)
          at org.eclipse.jdt.internal.jarinjarloader.JarRsrcLoader.main(JarRsrcLoader.java:58)
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1682)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:257)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:251)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1168)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:609)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:545)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:930)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1175)
          at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:657)
          at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:108)
          at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
          at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
          at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:409)
          at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:352)
          at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:210)
          ... 19 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:324)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:224)
          at sun.security.validator.Validator.validate(Validator.java:235)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:230)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:270)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1147)
          ... 31 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:197)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:255)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:319)
          ... 37 more
  CommunicationException:sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  javax.naming.CommunicationException: simple bind failed: adapps.nms.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
          at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:215)
          at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2685)
          at com.sun.jndi.ldap.LdapCtx.&lt;init&gt;(LdapCtx.java:306)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
          at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
          at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
          at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
          at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
          at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
          at javax.naming.InitialContext.init(InitialContext.java:240)
          at javax.naming.ldap.InitialLdapContext.&lt;init&gt;(InitialLdapContext.java:151)
          at NMSLdapServiceDAOImpl.getLdapContext(NMSLdapServiceDAOImpl.java:149)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:97)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:109)
          at NMSLdapServiceDAOImpl.getUserByNTID(NMSLdapServiceDAOImpl.java:109)
          at NMSLdapServiceDAOImpl.main(NMSLdapServiceDAOImpl.java:287)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:616)
          at org.eclipse.jdt.internal.jarinjarloader.JarRsrcLoader.main(JarRsrcLoader.java:58)
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1682)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:257)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:251)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1168)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:153)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:609)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:545)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:930)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1175)
          at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:657)
          at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:108)
          at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
          at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
          at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:409)
          at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:352)
          at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:210)
          ... 20 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:324)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:224)
          at sun.security.validator.Validator.validate(Validator.java:235)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:147)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:230)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:270)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1147)
          ... 32 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:197)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:255)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:319)
          ... 38 more
  </code></pre>