title: Is it possible to reuse Java trusted certificates for javax.ws.rs (Resteasy implementation)?
body: <p>Suppose we need to trust a self-signed SSL certificate. As an example, let's use <a href="https://self-signed.badssl.com/" rel="noreferrer">https://self-signed.badssl.com/</a>.</p>
  
  <p>Since the signer is not a "proper" authority, Java doesn't trust it and refuses to connect to that server. However, after</p>
  
  <pre><code>$ cd $JAVA_HOME/jre/lib/security
  $ keytool -import -trustcacerts -alias ... -file ... -keystore cacerts
  </code></pre>
  
  <p>and restart of the application, the following code works:</p>
  
  <pre><code>new URL ("https://self-signed.badssl.com/").openConnection ().getResponseCode ()
  </code></pre>
  
  <p>and returns 200 (OK), without throwing an exception.  I.e. basic Java way of opening an HTTPS connection now works, since the certificate is now trusted.</p>
  
  <p>However, this doesn't have any visible effect on javax.ws.rs Client (as implemented in Resteasy, at least) and I still get an exception:</p>
  
  <pre><code>javax.ws.rs.ProcessingException: Unable to invoke request
          at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)
          at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)
          at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.method(ClientInvocationBuilder.java:273)
          [...]
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1506)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
          at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:535)
          at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:403)
          at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
          at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304)
          at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
          at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
          at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57)
          at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
          ... 90 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
          at sun.security.validator.Validator.validate(Validator.java:260)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
          at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1488)
          ... 107 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
          ... 113 more
  </code></pre>
  
  <p>It seems as Resteasy doesn't take "standard" keystore into account.  But I would rather like to have a central (machine-specific) place for additional trusted keys and not bother how exactly application uses them, with <code>URL.openConnection</code> or javax.ws.rs.</p>
  
  <p><strong>Question</strong>
  Is it possible to make javax.ws.rs <code>Client</code> use <em>the same</em> keystore as "normal" Java HTTPS connection mechanism?</p>