title: Intercept SSLHandshakeException in Spring boot
body: <p>We have a rest API written in SpringBoot using a 2-way ssl Auth.
  We would like to send 401 HTTP status code when the user selects the wrong/expired client certificate.</p>
  <p>When it happens I can see the exception:</p>
  <pre><code>javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  <p>The API starts normally and works fine. The exception occurs whenever the user tries to call my api selecting a wrong client certificate or invalid. In this case I would like to return 401 to the caller</p>
  <p>Spring boot is configured with Tomcat and <code>@EnableWebSecurity</code></p>
  <pre><code>http.x509().subjectPrincipalRegex(&quot;XXXXXX&quot;).userDetailsService(this.userDetailsService);
  ((RequiresChannelUrl)http.requiresChannel().anyRequest()).requiresSecure();
  ....
   http.exceptionHandling()
                      .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
  
  
  public TomcatConnectorCustomizer httpsConnectorCustomizer(....) {
      return (connector) -&gt; {
          connector.setScheme(&quot;https&quot;);
          connector.setPort(port);
          Http11NioProtocol protocol = (Http11NioProtocol) connector.getProtocolHandler();
          protocol.setSSLEnabled(true);
          protocol.setSecure(true);
          protocol.setPort(port);
          protocol.setClientAuth(&quot;optional&quot;);
          protocol.setKeystoreFile(...);
          protocol.setKeystorePass(...);
          protocol.setKeystoreType(...);
          protocol.setKeyAlias(...);
          protocol.setTruststoreFile(...);
          protocol.setTruststorePass(...);
          protocol.setTruststoreType(...);
      };
  }
  </code></pre>
  <p>Here the stack trace:</p>
  <pre><code>DirectJDKLog.java:175 [] Handshake failed during wrap
  javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
  ...
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
  ....
  ....
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
  </code></pre>
  <p>The browser shows: ERR_BAD_SSL_CLIENT_AUTH_CERT<br />
  Is it possible to catch this exception in SpringBoot and send a specific HTTP status code?</p>
  <p>It seems that the exception is deep down in java/tomcat and so far I was not able to catch it.</p>