Got it, let's walk through this problem clearly—you're right that conn.getServerCertificates() won't return the root CA, and here's why, plus how to fix it with CertPathBuilder (and other alternatives):

为什么当前代码拿不到根CA？ #

When a server establishes an HTTPS connection, it doesn't send the root CA certificate—only the end-entity (leaf) certificate and any intermediate certificates needed to chain up to a trusted root. The root CA lives in your local system's trust store, which Java uses to verify the chain. That's why getServerCertificates() only gives you the server-provided certs, not the root.

是的，CertPathBuilder是正确的工具 #

It's designed to build a complete, valid certificate chain by linking the server-provided certs to a trusted root from your local store. Let's break down how to get the required inputs:

1. 如何获取 intermediateCerts？ #

Exactly as you guessed: this is the array returned by conn.getServerCertificates(). These are all the certificates the server sent you (leaf + intermediates). For Google's case, this would include the Google leaf cert and the GTS CA 1C3 intermediate, but not GeoTrust Global CA.

2. 如何获取 trustedRootCerts？ #

You need to load the system's trusted root CA store. Here's how to do that in Java:

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
trustStore.load(null, null); // Loads the system default trust store

// Extract trusted root certificates
Collection<X509Certificate> trustedRootCerts = new ArrayList<>();
Enumeration<String> aliases = trustStore.aliases();
while (aliases.hasMoreElements()) {
    String alias = aliases.nextElement();
    if (trustStore.isCertificateEntry(alias)) {
        Certificate cert = trustStore.getCertificate(alias);
        if (cert instanceof X509Certificate) {
            X509Certificate x509Cert = (X509Certificate) cert;
            // Check if it's a root CA (self-signed)
            if (x509Cert.getSubjectDN().equals(x509Cert.getIssuerDN())) {
                trustedRootCerts.add(x509Cert);
            }
        }
    }
}

3. selector.setCertificate(cert) 该用哪个证书？ #

You want to set the leaf certificate from the server's cert array—this is the first element in certs (since getServerCertificates() returns the leaf first, followed by intermediates in order up the chain).

完整的 CertPathBuilder 示例代码 #

URL destinationURL = new URL("https://google.com");
HttpsURLConnection conn = (HttpsURLConnection) destinationURL.openConnection();
conn.connect();
Certificate[] serverCerts = conn.getServerCertificates();

// Step 1: Get leaf certificate (first in array)
X509Certificate leafCert = (X509Certificate) serverCerts[0];

// Step 2: Load trusted root certs (code from above)
KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
trustStore.load(null, null);
Collection<X509Certificate> trustedRootCerts = new ArrayList<>();
Enumeration<String> aliases = trustStore.aliases();
while (aliases.hasMoreElements()) {
    String alias = aliases.nextElement();
    if (trustStore.isCertificateEntry(alias)) {
        Certificate cert = trustStore.getCertificate(alias);
        if (cert instanceof X509Certificate) {
            X509Certificate x509Cert = (X509Certificate) cert;
            if (x509Cert.getSubjectDN().equals(x509Cert.getIssuerDN())) {
                trustedRootCerts.add(x509Cert);
            }
        }
    }
}

// Step 3: Build the cert path
CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX");
PKIXBuilderParameters params = new PKIXBuilderParameters(trustStore, new X509CertSelector());
params.setRevocationEnabled(false); // Disable CRL check for simplicity (adjust as needed)
params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(List.of(serverCerts))));

X509CertSelector selector = (X509CertSelector) params.getTargetCertConstraints();
selector.setCertificate(leafCert);

// Build and get the complete chain
CertPathBuilderResult result = cpb.build(params);
CertPath certPath = result.getCertPath();
List<? extends Certificate> fullChain = certPath.getCertificates();

// The last element in fullChain is the trusted root CA (GeoTrust Global CA for Google)
X509Certificate rootCa = (X509Certificate) fullChain.get(fullChain.size() - 1);
System.out.println("Root CA Subject: " + rootCa.getSubjectDN());

其他获取根CA的方法 #

If you don't want to use CertPathBuilder, you can directly check which root CA in your trust store can verify the server's chain:

// Take the last intermediate cert from serverCerts
X509Certificate lastIntermediate = (X509Certificate) serverCerts[serverCerts.length - 1];

// Iterate through trusted roots to find the one that signed it
for (X509Certificate root : trustedRootCerts) {
    try {
        lastIntermediate.verify(root.getPublicKey());
        System.out.println("Matching Root CA: " + root.getSubjectDN());
        break;
    } catch (Exception e) {
        // Not the matching root, continue
    }
}

内容的提问来源于stack exchange，提问作者Krishnaraj