一、背景

Azure作為微軟的公有云平臺，提供了非常豐富的SDK和API讓開發(fā)人員可以非常方便的調(diào)用的各項服務(wù)。公司業(yè)務(wù)需要，我們需要訪問Azure上注冊的應(yīng)用程序，需要訪問https地址

https://login.microsoftonline.com/?your-??tenant-id 。

二、錯誤信息

簡短報錯信息：javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[na:1.8.0_332]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:324) ~[na:1.8.0_332]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:267) ~[na:1.8.0_332]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:262) ~[na:1.8.0_332]
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654) ~[na:1.8.0_332]
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473) ~[na:1.8.0_332]
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369) ~[na:1.8.0_332]
        at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377) ~[na:1.8.0_332]
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) ~[na:1.8.0_332]
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422) ~[na:1.8.0_332]
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:182) ~[na:1.8.0_332]
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:152) ~[na:1.8.0_332]
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1397) ~[na:1.8.0_332]
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1305) ~[na:1.8.0_332]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440) ~[na:1.8.0_332]
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559) ~[na:1.8.0_332]
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197) ~[na:1.8.0_332]
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1572) ~[na:1.8.0_332]
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1500) ~[na:1.8.0_332]
        at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480) ~[na:1.8.0_332]
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352) ~[na:1.8.0_332]
        at com.microsoft.aad.msal4j.DefaultHttpClient.readResponseFromConnection(DefaultHttpClient.java:105) ~[msal4j-1.13.0.jar!/:1.13.0]
        at com.microsoft.aad.msal4j.DefaultHttpClient.executeHttpGet(DefaultHttpClient.java:47) ~[msal4j-1.13.0.jar!/:1.13.0]
        at com.microsoft.aad.msal4j.DefaultHttpClient.send(DefaultHttpClient.java:35) ~[msal4j-1.13.0.jar!/:1.13.0]
        at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequestWithRetries(HttpHelper.java:96) ~[msal4j-1.13.0.jar!/:1.13.0]
        at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequest(HttpHelper.java:49) ~[msal4j-1.13.0.jar!/:1.13.0]
        ... 16 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:456) ~[na:1.8.0_332]
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:323) ~[na:1.8.0_332]
        at sun.security.validator.Validator.validate(Validator.java:271) ~[na:1.8.0_332]
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:315) ~[na:1.8.0_332]
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:223) ~[na:1.8.0_332]
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129) ~[na:1.8.0_332]
        at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638) ~[na:1.8.0_332]
        ... 37 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[na:1.8.0_332]
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) ~[na:1.8.0_332]
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[na:1.8.0_332]
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:451) ~[na:1.8.0_332]
        ... 43 common frames omitted

2022-08-16 17:26:53.542 ERROR 3480 --- [   scheduling-1] c.xx.xx.service.impl.XXServiceImpl  : get new EWS Token With Certificate error : java.util.concurrent.ExecutionException: com.microsoft.aad.msal4j.MsalClientException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

三、問題原因和解決思路

Java的keystore當(dāng)中沒有該網(wǎng)站https證書。需要手動使用keytool命令導(dǎo)入到j(luò)re里面。當(dāng)然我們也可以使用Java的TrustManager忽略所有的SSL請求的證書(不推薦用于生產(chǎn)環(huán)境)。本次我們是直接導(dǎo)入對應(yīng)的證書到j(luò)re里面來解決問題。

四、獲取網(wǎng)站的證書

1.谷歌瀏覽器直接訪問 https://login.microsoftonline.com/

快捷鍵F12進(jìn)入開發(fā)者模式。進(jìn)入security安全菜單下，可以看到顯示“This page is secure (valid HTTPS)”，點擊“view certificate ”

?在證書界面，我們可以將證書復(fù)制到以便查看。

直接下一步，導(dǎo)出格式選擇base64編碼。

?設(shè)置證書路徑和文件名，點擊完成即可。最終格式的.cer文件。

五、導(dǎo)入證書

將證書放在某個位置，建議放在C盤cert文件。

管理員運行控制臺

先進(jìn)入到Java的bin文件夾，我這里是

cd C:\Program Files\Java\jdk1.8.0_192\bin

?執(zhí)行下面的命令導(dǎo)入指定證書(需要根據(jù)自己的實際修改)

keytool -import -alias login.microsoftonline.com -keystore "C:\Program Files\Java\jre1.8.0_192\lib\security\cacerts" -file c:\cert\login.microsoftonline.com.cer

-alias 后面是別名

-keystore 后面是keystore路徑

-file 后面是剛剛導(dǎo)出的證書文件路徑

安裝證書與查看證書默認(rèn)密碼是changeit

六、查看證書

# 查看所有證書

keytool -list -keystore "C:\Program Files\Java\jre1.8.0_192\lib\security\cacerts"

# 查看指定名字的證書文章來源地址http://www.zghlxwxcb.cn/news/detail-457036.html

keytool -list -v -alias login.microsoftonline.com -keystore "C:\Program Files\Java\jre1.8.0_192\lib\security\cacerts" -storepass changeit

到了這里，關(guān)于Java調(diào)用Azure證書錯誤javax.net.ssl.SSLHandshakeException的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！