Unable to Find Valid Certification Path to Requested Target

The Unable to Find Valid Certification Path to Requested Target error is a common error that developers working with Java and SSL certificates face.

This kind of error usually means the requests an application is making to the external service are blocked due to an invalid SSL certificate error or certificate chain not being trusted.

Table of Contents

What Does Unable to Find Valid Certification Path to Requested Target Mean?

Experiencing an Unable to Find Valid Certification Path to Requested Target error means that the Java application is unable to validate the SSL cert to the requested target. This could be because the Server certificate is either self-signed, expired, or not present in the java trust store.

Common Causes of the Error

Below are the most encountered causes of the unable to find a valid certification path to the requested target error:

Self-signed SSL certificates
SSL certificates are missing in the Java Keystore
This typically happens due to an Incorrect Keystore configuration
Outdated Java versions (JDK 11)
Chain of insecure or untrusted certificates
API calls through Postman without any trusted certificates

How to Fix “Unable to Find Valid Certification Path to Requested Target” Error

This error can be solved by applying the following step-by-step solutions;

Import SSL Certificate into Java Keystore

Importing SSL certificates into Java Keystore is one of the best solutions to fix the error.

Steps to Fix:

Run this command to download the SSL certificate from the target server.
Import the certificate using the key tool command:

keytool -import -trustcacerts -file certificate.crt -keystore cacerts -alias mycert

You are not allowed to run this command on the Slack server, where you see the same logs through different architectures.
Restart the application.

Check Trust Store Configuration

If the problem of the trust store certificate not found still does exist, please double-check if the application is hitting the appropriate Java trust store.

Example Configuration for Spring Boot:

server:
  ssl:
    trust-store: classpath:truststore.jks
    trust-store-password: password

Fix SSL Handshake Exception

The client and server opt not to build a secure channel, resulting in a handshake exception.

Solution:

Replace the cacerts file located in the JDK installation directory.
Confirm that the server certificate was signed by a trusted CA.

Unable to Find Valid Certification Path to Requested Target in Postman

The unable to find valid certification path to requested target Postman error commonly occurs when sending requests to secure endpoints in Postman.

Fix:

In Postman, head over to Settings → Certificates.
In CA certificates, include the certificate.
Restart Postman.

Unable to Find a Valid Certification Path in IntelliJ

In IntelliJ, a trust error happens due to the IDE doesn’t trust the server certificate.

Steps to Fix:

The first step is to go to Preferences → Tools → Server Certificates.
Import the server SSL certificate.
Restart IntelliJ.

Unable to Find a Valid Certification Path to the Requested Target with Docker

The container probably doesn’t trust the certificate (if on Docker)

Fix:

In this way, the certificates will be stored in the trusted directory inside the docker container.

docker run --volume /path/to/certs:/etc/ssl/certs myapp

Could Not Find a Valid Certification Path to the Requested Target in Maven

If you have remote repositories defined that are untrusted, maven builds fail while maven is downloading dependencies.

Solution:

Add SSL certificate into Java keystore.
Add the following JVM option to the build:

-Djavax.net.ssl.trustStore=/path/to/cacerts

Unable to Find Valid Certification Path to Requested Target in Android Studio

In the case of Android Studio, we can resolve the issue by just adding the server certificate to the Network Security Config of your application.

Example XML Configuration:

<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">example.com</domain>
    </domain-config>
</network-security-config>

How to Import Certificate to Keystore

Steps for importing the certificate to Keystore (If you don’t know how to do this):

Download the certificate.
Import the certificate using keytool
Verify the import using:

keytool -list -v -keystore cacerts

Conclusion

In this post, we will address a common error you may encounter when making secure API requests, particularly in Java applications: the unable to find a valid certification path to the requested target error. This guide covers the troubleshooting steps from working with Spring Boot, Maven, and Docker to Android Studio.

Properly managing SSL certificates with the Java Keystore in development environments is vital for successful and secure Java applications that communicate with external services.