title: Setting up SSL in Java 6 (GlassFish 3 server)
body: <p>We have a Java web application running inside GlassFish 3 web server.    </p>
  
  <p>Our application connects to a LDAP server for authentication. Now customer is running LDAP on SSL i.e <code>ldaps</code>.</p>
  
  <p>So we fetched the certificate from their LDAP server and added it to our trusted certificate. But still we sometime gets:</p>
  
  <p><code>exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]</code></p>
  
  <p>Further investigation by LDAP admin, his words:</p>
  
  <blockquote>
    <p>"We added additional servers behind the load balancer.  If they
    trust just the server CERT instead of the CA then you would be
    experiencing this problem.  They should trust the CA or should not
    perform any certificate validation"</p>
  </blockquote>
  
  <p>Which means that there are many LDAP server running behind the load balancer and each server has different certificate, and we just trust on one particular certificate.</p>
  
  <p>Now the resolution they say is to trust on the CA and not on individual certificate.    </p>
  
  <hr>
  
  <p>NOW at this point I am confused!</p>
  
  <p>Is it the case that we can get a CA certificate and trust on it so that any certificate issued by that CA will be automatically trusted.. </p>
  
  <p>If so how to do that?</p>
  
  <p>Will the CA certificate be fetched from the LDAP server or do we have to ask for it?</p>
  
  <p>Or have I created a wrong mind model for this or is there a concept missing?</p>
  
  <p>Also what is "trusted root certificate"?</p>