title: PKIX Path does not chain with any of the trust anchors error in Windows Environment
body: <p>I am a bit of an idiot to how SSL and Webservices work at the fine-grained level. I am developing a system that calls several web services, some with secured URLs and others that are not with little problem. Currently, however, I am doing an integration with Endicia's LabelServer Web API. The webservice is used to calculate and print postage.</p>
  
  <p>The test URL and WSDL is at: <a href="https://www.envmgr.com/LabelService/EwsLabelService.asmx" rel="noreferrer">https://www.envmgr.com/LabelService/EwsLabelService.asmx</a></p>
  
  <p>I used wsimport to create and setup a Java client for connecting to this webservice but when I try to all it I get the error</p>
  
  <blockquote>
    <p>PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors</p>
  </blockquote>
  
  <p>This error is documented here: <a href="https://stackoverflow.com/questions/11153058/java7-refusing-to-trust-certificate-in-trust-store">Java7 Refusing to trust certificate in trust store</a></p>
  
  <p>in which it's discussed how Java 7 forces an error with self-signed certificates with "bad" keyusage. Bad in this situation is defined as not containing keyCertSign. The webservice does work with Java 6. I can believe this situation might apply to this certificate since it's only being used as a test server, but I don't know how to verify that.</p>
  
  <p>There's a bug report on it that is solved (<a href="http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7018897" rel="noreferrer">http://bugs.java.com/bugdatabase/view_bug.do?bug_id=7018897</a>), but I'm not sure how any of this translates to fixing the problem for a Windows Tomcat environment. I exported the certificate onto my machine, but am uncertain of how to proceed from there. </p>
  
  <p>EDIT:
  I tried using OpenSSL to modify the certificate and add it to my keystore as described in the "Refusing to trust certificate in trust store" link and it didn't work. It seems like this is a process that is done by the owner of the certificate, right? I wonder if there's some way I can configure my Java 7 environment to let this certificate through.</p>