title: PKIX path building for internal CA
body: <p>I'm trying to get a couple of applications linked together correctly in Tomcat but I'm getting the following. </p>
  
  <pre><code>Invalid response from getting the pageId: javax.net.ssl.SSLHandshakeException: 
  sun.security.validator.ValidatorException: PKIX path building failed: 
      sun.security.provider.certpath.SunCertPathBuilderException: 
      unable to find valid certification path to requested target
  </code></pre>
  
  <p>I've dealt with this in the past using an internal CA without issue. </p>
  
  <p>My current server.xml looks like this:</p>
  
  <pre><code>  &lt;Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               ....
               keystoreFile="/jira-home/jira.example.org.p12"
               keystorePass="xxx"
               keystoreType="pkcs12"
               keyAlias="jira.example.org"
               truststoreFile="/jira-home/jira.example.org.p12"
               truststoreType="pkcs12"
               truststorePass="xxx"
               /&gt;
  </code></pre>
  
  <p>I've also verified that the command line arguments to the Java executable aren't overriding the keystore / truststore values. </p>
  
  <p>My p12 file also looks good as far as I can tell. </p>
  
  <pre><code>Bag Attributes
      localKeyID: 47 96 87 64 A2 A0 66 C3 B7 3C 09 53 BD 22 ED 50 37 DE 62 B7
      friendlyName: jira.example.org
  subject=/C=US/ST=Kansas/L=Kansas City/O=CFCA/OU=IS/CN=jira.example.org
  issuer=/DC=org/DC=example/CN=example-CA2-CA
  -----BEGIN CERTIFICATE-----
  MIIF1TCCBL2gAwIBAgIKEOfX4AAAAAAB5zANBgkqhkiG9w0BAQUFADBHMRMwEQYK
  k8ThWdXWScM8
  -----END CERTIFICATE-----
  Bag Attributes: &lt;No Attributes&gt;
  subject=/CN=CA2.example.org
  issuer=/DC=org/DC=example/CN=example-CA2-CA
  -----BEGIN CERTIFICATE-----
  MIIE0jCCA7qgAwIBAgIKYQCskwAAAAAIFTANBgkqhkiG9w0BAQUFADBHMRMwEQYK
  motn49ZLI61VXW4KrM2ZCgSOu1O5DMqLnd4DZCgHxvYwckemqDo=
  -----END CERTIFICATE-----
  Bag Attributes: &lt;No Attributes&gt;
  subject=/CN=OFFLINECA2-CA
  issuer=/CN=OFFLINECA2-CA
  -----BEGIN CERTIFICATE-----
  MIIDMjCCAhqgAwIBAgIQIvkuOz6aNL5K+7XhjbwOMDANBgkqhkiG9w0BAQUFADAY
  MF2ktx6a
  -----END CERTIFICATE-----
  Bag Attributes
      localKeyID: 47 96 87 64 A2 A0 66 C3 B7 3C 09 53 BD 22 ED 50 37 DE 62 B7
      friendlyName: jira.example.org
  Key Attributes: &lt;No Attributes&gt;
  -----BEGIN PRIVATE KEY-----
  xxxxxxxxxxxxxxxxxxxxxx
  -----END PRIVATE KEY-----
  </code></pre>
  
  <p>All of the other application servers I'm connecting to also are from the same intermediate and root CA. </p>