Java环境PKIXValidator无法解析通配符TLS证书问题咨询

问题现象 #

火狐、Chrome等浏览器可正常验证通配符TLS证书有效性，但Java驱动的程序校验失败，报错信息如下：

certpath: Constraints: ...
...

...

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:349)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:287)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
    at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1426)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1336)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:421)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:374)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
    at org.llorllale.youtrack.api.DefaultProjects.get(DefaultProjects.java:80)
    at com.company.youtrack.Main.main(Main.java:121)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at java.base/sun.security.validator.Validator.validate(Validator.java:264)
    at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
    ... 25 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 31 more

根因说明 #

• 通配符证书本身不会导致该校验异常：Java原生支持通配符证书的域名校验规则，可排除该因素
• 浏览器校验通过的核心原因：浏览器内置了常用CA中间证书缓存，同时支持AIA自动下载缺失的中间证书，因此即使服务端返回证书链不全也可完成校验
• Java校验失败的核心原因：Java默认不启用AIA自动下载中间证书的逻辑，仅会从本地信任库中匹配信任锚，当服务端返回的证书链缺失二级中间证书时，无法完成完整的信任链构建，因此抛出PKIX路径构建失败异常

解决思路 #

服务端永久修复（推荐） #

在YouTrack服务端的TLS配置中上传完整证书链，包含服务端证书、所有层级的中间证书，根证书无需配置在服务端返回序列中，只要客户端信任对应根证书即可完成校验。

客户端临时修复（无需修改服务端配置） #

两种可选方案：

1. 导入缺失证书到JRE全局信任库
   首先导出缺失的二级中间证书、根证书为PEM格式文件，执行如下命令导入到对应Java运行环境的信任库中：

   # 导入二级中间证书
   keytool -importcert -alias <自定义中间证书别名> -file <中间证书文件路径> -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
   # 导入根证书
   keytool -importcert -alias <自定义根证书别名> -file <根证书文件路径> -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
   

   注意替换命令中的占位符为实际值，若你修改过JRE默认信任库密码，将changeit替换为实际密码即可。
2. 代码层面自定义信任规则
   若不想修改全局JRE配置，可在初始化HTTP客户端时手动加载完整证书链，构造自定义的SSL上下文和TrustManager，仅适用于内网可信环境，避免降低全局安全校验等级。

内容的提问来源于stack exchange，提问作者Andreas Zimmermann