java.security.cert.CertPathValidatorException : Certificate chaining error

Question

访问 https://..appRoot../TestJavaMongo/test/mongo/all 时出现以下应用程序错误按照文档:https://medium.com/@blumareks/mongodb-for-you-a-hardcore-java-cloud-developer-f67b909834f4

我正在测试从 IBM Cloud 上的 Liberty Java CF 应用程序连接 Mongo DB 服务。如何解决该错误？

``` Error 500: com.mongodb.MongoTimeoutException: Timed out after 30000 ms while waiting for a server that matches WritableServerSelector. Client view of cluster state is {type=UNKNOWN, servers=[{address=sl-us-south-1-portal.16.dblayer.com:50233, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketWriteException: Exception sending message},

caused by {javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by CN=********* is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error}, ...

$ keytool -list -v -keystore mongoKeyStore输入 keystore 密码:

Keystore type: JKS Keystore provider: SUN

Your keystore contains 1 entry

Alias name: mykey Creation date: 24/06/2017 Entry type: trustedCertEntry

Owner: CN=mwsadows@us.ibm.com-0b24b0ff06b390e0cc5e803aecd5ec82 Issuer: CN=mwsadows@us.ibm.com-0b24b0ff06b390e0cc5e803aecd5ec82 Serial number: 59491e1b Valid from: Tue Jun 20 23:07:39 AEST 2017 until: Sat Jun 20 23:00:00 AEST 2037 Certificate fingerprints: MD5: A4:54:21:6A:52:E1:8B:CB:07:CC:25:A3:3B:1A:8B:05 SHA1: BE:5D:AE:94:C3:A5:37:2D:43:B2:E7:FC:CF:39:19:EE:B8:10:29:9B SHA256: D5:6B:EB:D6:88:36:D4:77:06:9B:8D:2B:83:39:9B:95:A5:E3:22:09:99:EF:32:89:31:E2:88:C2:86:58:83:62 Signature algorithm name: SHA512withRSA Version: 3

Extensions:

1: ObjectId: 2.5.29.35 Criticality=false AuthorityKeyIdentifier [ KeyIdentifier [ 0000: 65 2C 47 37 D6 4C B7 24 E9 A1 AA 14 01 4A 12 AD e,G7.L.$.....J.. 0010: 63 E0 7C 56
c..V ] ]

2: ObjectId: 2.5.29.19 Criticality=false BasicConstraints:[ CA:true PathLen:2147483647 ]

3: ObjectId: 2.5.29.37 Criticality=false ExtendedKeyUsages [ serverAuth clientAuth ]

4: ObjectId: 2.5.29.15 Criticality=true KeyUsage [ Key_CertSign ]

5: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 65 2C 47 37 D6 4C B7 24 E9 A1 AA 14 01 4A 12 AD e,G7.L.$.....J.. 0010: 63 E0 7C 56
c..V ] ]

Answer 1

我最近与我们的数据库提供商遇到了同样的问题，他们向我发送了他们的 .crt 文件，我必须用它创建一个 keystore 。

keytool -import -alias "name" -file "/path/to/file" -keystore "/path/to/keystore/file" -storetype pkcs12 -storepass "keystorepass"

然后在我的主类中我定义了信任库和信任库传递:

 System.setProperty("javax.net.ssl.trustStore", "/path/to/keystore/file");
 System.setProperty("javax.net.ssl.trustStorePassword", "keystorepass");  

希望有帮助。