MQTT.fx连接AWS IoT触发MqttException错误求助

最近跟着AWS IoT的入门教程折腾，反复走了好几遍步骤，结果MQTT.fx一点「连接」就报MqttException，看日志发现是SSL握手时的PKIX路径问题——说白了就是Java找不到能信任AWS服务器证书的根CA。我把排查和解决的步骤整理出来，你可以照着试试：

核心问题定位 #

日志里的关键错误提示是：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

这基本就是证书配置出问题了，大概率是根CA证书没配对或者没导入。

具体解决步骤 #

• 先确认证书文件是否完整
  从AWS IoT下载证书时，必须拿到三个文件：设备证书（.cert.pem）、私有密钥（.private.key），还有Amazon根CA证书（通常是AmazonRootCA1.pem）。很多人容易漏下根CA，这玩意儿是验证AWS服务器身份的关键，没它肯定握手失败。

• 核对MQTT.fx的SSL配置
  打开MQTT.fx的连接设置，切换到SSL/TLS标签页：

  1. 勾选「Use SSL/TLS」，选择「CA signed server certificates」模式
  2. 「CA File」一定要指向你下载的AmazonRootCA1.pem文件（比如路径C:\temp\AmazonRootCA1.pem）
  3. 「Client Certificate」选择你的设备证书，「Client Key」选择对应的私有密钥
     注意路径别写错，Windows下尽量避免中文或特殊字符，有空格的话要给路径加引号。

• 手动导入根CA到Java信任库（若前两步无效）
  有时候JVM默认信任库没包含AWS的根CA，需要手动添加：

  1. 找到你的Java安装目录下的lib\security\cacerts文件，比如JRE 1.8.0_162的路径是C:\Program Files\Java\jre1.8.0_162\lib\security\cacerts，默认密码是changeit
  2. 打开管理员权限的命令提示符，运行以下命令：

     keytool -import -alias AmazonRootCA1 -file C:\temp\AmazonRootCA1.pem -keystore "C:\Program Files\Java\jre1.8.0_162\lib\security\cacerts"
     

  3. 输入密码后，确认信任该证书（输入y），然后重启MQTT.fx再尝试连接。

• 最后检查Broker地址和端口
  别光顾着证书，再核对一下AWS IoT的端点地址（在IoT Core控制台「设置」里可查看），端口必须选8883（MQTT over SSL的标准端口），别选错成1883或其他端口。

完整错误日志 #

2020-10-09 10:40:28,043 ERROR --- MqttFX ClientModel : Please verify your Settings (e.g. Broker Address, Broker Port & Client ID) and the user credentials! 
org.eclipse.paho.client.mqttv3.MqttException: MqttException 
at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:38) ~[org.eclipse.paho.client.mqttv3-1.2.0.jar:?] 
at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:715) ~[org.eclipse.paho.client.mqttv3-1.2.0.jar:?] 
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) ~[?:1.8.0_162] 
at java.util.concurrent.FutureTask.run(Unknown Source) ~[?:1.8.0_162] 
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown Source) ~[?:1.8.0_162] 
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) ~[?:1.8.0_162] 
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_162] 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_162] 
at java.lang.Thread.run(Unknown Source) [?:1.8.0_162] 
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.Handshaker.fatalSE(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.Handshaker.fatalSE(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.Handshaker.processLoop(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.Handshaker.process_record(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) ~[?:1.8.0_162] 
at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:108) ~[org.eclipse.paho.client.mqttv3-1.2.0.jar:?] 
at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:701) ~[org.eclipse.paho.client.mqttv3-1.2.0.jar:?] 
... 7 more 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
at sun.security.validator.PKIXValidator.doBuild(Unknown Source) ~[?:1.8.0_162] 
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) ~[?:1.8.0_162] 
at sun.security.validator.Validator.validate(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ~[?:1.8.0_162] 
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) ~[?:1.8.0_162] 
... 10 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) ~[?:1.8.0_162] 
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) ~[?:1.8.0_162] 
at java.security.cert.CertPathBuilder.build(Unknown Source) ~[?:1.8.0_162] 
at sun.security.validator.PKIXValidator.doBuild(Unknown Source) ~[?:1.8.0_162] 
... 16 more 
2020-10-09 10:40:28,045 INFO --- ScriptsController : Clear console. 
2020-10-09 10:40:28,046 ERROR --- BrokerConnectService : MqttException

内容的提问来源于stack exchange，提问作者firefighter