案例分享-https证书链不完整导致请求失败

背景话不多说 , 直接上堆栈
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)  at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)  at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)  at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)  at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1514)  at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)  at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)  at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)  at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)  at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)  at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)  at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)  at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)  at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)  at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)  at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)  at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)  at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)  at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)  at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)  at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)  at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)  at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)  at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)  at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)  at sun.security.validator.Validator.validate(Validator.java:260)  at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)  at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)  at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)  at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)  ... 51 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)  at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)  at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)  at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)  ... 57 more上面是某客户环境出现的错误,从错误信息中大概猜测是https证书出了问题 , 据开发反馈这个接口使用了近半年,一直没有问题,我随即跟运维打探情况,看近期是否有什么调整 。
果然,由于客户的证书即将到期,所以申请了新证书,昨天晚上刚更新到nginx上去,但是更新完以后客户、实施都在浏览器测试了,并没有问题 , 怎么程序里HttpClient访问就报错了呢?
带着疑问我又测试了curl命令和postman工具,接连失败,如下图所示:

案例分享-https证书链不完整导致请求失败

文章插图

案例分享-https证书链不完整导致请求失败

文章插图
发现新大陆机缘巧合下我发现了一个好用的ssl工具网站myssl.com,目前解锁了两个很实用的工具,在这里推荐给大家:

推荐阅读