title: Java Certificate / Keystore Exceptions
body: <p>When attempting to implement a keystore into a Java SOAP client for accessing a WS, I get the exception:</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>We identified that the cause of this was the CA (DigiSign) wasn't in the Java trusted CA.
  Initially I used two certificates that were given to me by one of our senior engineers and combined them via keytool:</p>
  
  <pre><code>keytool.exe -v -alias digicert_3 -import -file DigiCertHighAssuranceCA-3.pem -keystore mykeystore.jks
  keytool.exe -v -alias digicert_root -import -file DigiCertHighAssuranceEVRootCA.pem -keystore mykeystore.jks
  </code></pre>
  
  <p>I then copied the keystore.jks file into the Eclipse project under src/main/resources.</p>
  
  <p>However, now I am getting other exceptions. I have tried multiple ways of loading the certificates into a keystore and I am getting various exceptions.</p>
  
  <p>Here are the different ways I've tried to implement the keystores (one at a time):</p>
  
  <pre><code>//Load keystore from project resource
  KeyStore keyStore = KeyStore.getInstance("JKS");
  
  //Keystore created using two individual PEM certs
  //Exception: java.io.IOException: Keystore was tampered with, or password was incorrect
  keyStore.load(Thread.currentThread().getContextClassLoader().getResourceAsStream("mykeystore_PEM.jks"), "password".toCharArray());
  
  //Keystore created with two certs combined into a single file
  //Exception: java.io.IOException: Keystore was tampered with, or password was incorrect
  keyStore.load(Thread.currentThread().getContextClassLoader().getResourceAsStream("mykeystore_Com.jks"), "password".toCharArray());
  
  //Keystore created using two individual DER cert calls
  //Exception: java.io.IOException: DerInputStream.getLength(): lengthTag=127, too big.
  keyStore.load(Thread.currentThread().getContextClassLoader().getResourceAsStream("mykeystore_DER.jks"), "password".toCharArray());
  
  //Keystore created using InstallCert
  //Exception: java.security.cert.CertificateParsingException: java.io.IOException: insufficient data
  keyStore.load(Thread.currentThread().getContextClassLoader().getResourceAsStream("jssecacerts"), "changeit".toCharArray());
  
  TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
  trustFactory.init(keyStore);
  TrustManager[] trustManagers = trustFactory.getTrustManagers();
  tlsParams.setTrustManagers(trustManagers);
  conduit.setTlsClientParameters(tlsParams);
  HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();
  httpClientPolicy.setConnectionTimeout(36000);
  httpClientPolicy.setAllowChunking(false);
  httpClientPolicy.setReceiveTimeout(32000);
  conduit.setClient(httpClientPolicy);
  </code></pre>
  
  <p>1 &amp; 2.) I've verified and double-checked the password, so I don't know why the first two fail with that error.</p>
  
  <p>3.) On the third exception about the length, I have read that it is commonly an issue with data after the END CERTIFICATE line. I've tried it with single blank line after (gives the 'too big' exception) or with the last line being the END CERTIFICATE line (gives some other exception).</p>
  
  <p>4.) Running the InstallCert class from <a href="http://nodsw.com/blog/leeland/2006/12/06-no-more-unable-find-valid-certification-path-requested-target" rel="nofollow">here</a>, I was prompted to take one certificate, and it shows in the keystore.</p>
  
  <p>Any idea why my keystores are not working? Is it something with Java code, or are the certificates/keystore not generating correctly?</p>