Steps to trouble shoot SSL

Question

I am trying to trouble shoot a two way SSL handshake mechanism. I get an error

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This indicates that one of my keystore or my truststore files does not have the appropriate entries. I know the way to trouble shoot this is to go to the server's truststore do the keytool list check the signing authorities and come to the client's key/truststore and verify this.

Can someone list these steps clearly (with the appropriate commands) please? Googling is not leading me anywhere. I just need a list of steps of "How can I confirm that Client X can talk to Server Y with two way SSL using Cert Z"?

Answer 1

The SunCertPathBuilderException exception is thrown whenever there the certificate validator fails to establish a chain between the certificate and a root certificate.

The easiest way to confirm that the certificate validates is to use a graphical tool like

• Keyman, or
• KeyTool IUI

The above tools are recommended since the exception is usually thrown in the absence of a root certificate.

If you want to examine what certificates are getting exchanged, it is better to switch on the ssl debug flag on the JVM node where the validation is failing.

Another option is to use a network traffic capture utility like Ethereal or Microsoft Netmon to obtain a dump of the traffic containing the certificate exchanges.

PS: Are you using the right keystore in the first place? I remember doing the same mistake many moons ago...