title: Resolving: SunCertPathBuilderException: unable to find valid certification path to requested target
body: <p>Full trace of my exception is:</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: 
  sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>First of all I'd like to say that I know that it's very common exception, and I tried to apply different solutions, I'll describe them later, but nothing help me.</p>
  
  <p>So, I have two instances of tomcat 7 on same machine. Directly speaking, these instances have each own <code>CATALINA_BASE</code> directory, but common <code>CATALINA_HOME</code>. Also they are isolated - ports configured so that instances don't interfere. One instance - server - with deployed web application, servlet. And another instance for client - servlet too.</p>
  
  <p>This is fragment of server.xml of server tomcat:</p>
  
  <pre><code>&lt;Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
          maxThreads="150" scheme="https" secure="true"
          clientAuth="true" sslProtocol="TLS" 
          truststoreFile="C:/Users/dpivovar/ssl_server.jks" 
          truststorePass="start123"
          keystoreFile="C:/Users/dpivovar/ssl_server.jks" 
          keystorePass="start123"/&gt;
  </code></pre>
  
  <p>And this fragment of client tomcat:</p>
  
  <pre><code>&lt;Connector port="8444" protocol="HTTP/1.1" SSLEnabled="true"
          maxThreads="150" scheme="https" secure="true"
          clientAuth="false" sslProtocol="TLS" 
          truststoreFile="C:/Program Files/Java/jdk1.7.0_45/jre/lib/security/cacerts" 
          truststorePass="changeit"
          keystoreFile="C:/Users/dpivovar/ssl_client.jks" 
          keystorePass="start123" /&gt;
  </code></pre>
  
  <p>Work flow: client make attempt to do GET to the server, but it gets exception described above.</p>
  
  <p>What about certificates. I used java keytool. I made <code>one keystore for server and separate for client</code>. Each keystore contains <code>private key</code> and <code>public certificate</code> of corresponding side. In above example client truststore refere to the jre cacerts keystore, because one of solution i found was to put public certificate of server to the jre cacerts. but it doesn't work for me. 
  Another solution i found (<a href="http://www.nodsw.com/blog/leeland/2006/12/06-no-more-unable-find-valid-certification-path-requested-target" rel="nofollow">http://www.nodsw.com/blog/leeland/2006/12/06-no-more-unable-find-valid-certification-path-requested-target</a>) offers via InstallCert tool to get an public certificate of server and then use it in client truststore. So now, in jre caserts there is a public certificate of server but exception is raised.
  Also, i have a simple client example - it's plain java program, through system property i set required paths to keystores, which i use for client, and in the same way i make GET to the server and it works, handshake occured, connection established.</p>
  
  <p>So can you help me, what can be wrong, what prevents client which is deployed on tomcat to establish ssl connection with server?</p>