PKIX path building failed - Spring Boot Service on OpenShift

Question

I try to call a SSL secured Webservice from a Spring Boot Service running inside a Docker Container on OpenShift Platform.

I get the following error:

org.springframework.ws.client.WebServiceIOException: I/O error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
at org.springframework.ws.client.core.WebServiceTemplate.sendAndReceive(WebServiceTemplate.java:561) 
at org.springframework.ws.client.core.WebServiceTemplate.marshalSendAndReceive(WebServiceTemplate.java:390) 
at client.webClient.callServ(WebClient.java:45) 

That is my webclient:

public class webClient extends WebServiceGatewaySupport {

private String targetUrl = "https://service.com/REST/call";
private String soapActionCall = "http://soapurl.com";

@Autowired
@Qualifier("webServiceTemplateClient")
private WebServiceTemplate webServiceTemplateClient;

@Autowired
private ClientInterceptor interceptor;  

public ClientResponse callServ(ServData request) {
    try {
        ClientInterceptor[] interceptors = new ClientInterceptor[1];
        interceptors[0] = interceptor;
        webServiceTemplateClient.setInterceptors(interceptors);
        
        ClientResponse response = (ClientResponse) webServiceTemplateClient.marshalSendAndReceive(targetUrl,
                request, new MessageCallback(soapActionCall));
        return response;
    } catch (Exception ex) {
        ex.printStackTrace();
        return null;
    }

}
}

And here is the configuration:

@Configuration
public class ClientConfig {

private String username = "demo";
private String password = "demo";
private String defaultUri = "https://service.com/rest/call";
private String trustPassword = "secret";
private String trustStore = "/opt/app-root/ssl/key.jks";

@Autowired
private ResourceLoader resourceLoader;


@Bean
@Qualifier("marshallerClient")
public Jaxb2Marshaller marshallerClient() {
    Jaxb2Marshaller marshaller = new Jaxb2Marshaller();
    marshaller.setContextPath("client.Service");
    return marshaller;
}

@Bean
public ServClient servClient(@Qualifier("marshallerClient") Jaxb2Marshaller marshallerClient) {
    ServClient client = new ServClient();
    client.setDefaultUri(defaultUri);
    client.setMarshaller(marshallerClient);
    client.setUnmarshaller(marshallerClient);
    return client;
}

@Bean
@Qualifier("webServiceTemplateClient")
public WebServiceTemplate webServiceTemplateClient() {
    WebServiceTemplate webServiceTemplate = new WebServiceTemplate();
    webServiceTemplate.setMarshaller(marshallerClient());
    webServiceTemplate.setUnmarshaller(marshallerClient());
    webServiceTemplate.setDefaultUri("");
    webServiceTemplate.setMessageSender(httpComponentsMessageSenderClient());

    return webServiceTemplate;
}

@Bean
public HttpComponentsMessageSender httpComponentsMessageSenderClient() {
    HttpComponentsMessageSender httpComponentsMessageSender = new HttpComponentsMessageSender() ;
    // set the basic authorization credentials
    httpComponentsMessageSender.setCredentials(usernamePasswordCredentialsClient());
    return httpComponentsMessageSender;
}

@Bean
public UsernamePasswordCredentials usernamePasswordCredentialsClient() {
    // pass the user name and password to be used
    return new UsernamePasswordCredentials(security.decrypt(username), security.decrypt(password));
}

@Bean
public HttpsUrlConnectionMessageSender httpsUrlConnectionMessageSender() throws Exception {
    System.out.println("httpsUrlConnectionMessageSender");
    HttpsUrlConnectionMessageSender httpsUrlConnectionMessageSender = new HttpsUrlConnectionMessageSender();
    httpsUrlConnectionMessageSender.setTrustManagers(sessionTrustManagersFactoryBean().getObject());
    return httpsUrlConnectionMessageSender;
}

@Bean
public KeyStoreFactoryBean sessionTrustStore() {
    KeyStoreFactoryBean keyStoreFactoryBean = new KeyStoreFactoryBean();
    Resource resTrustStore = resourceLoader.getResource("file:" + trustStore);
    keyStoreFactoryBean.setLocation(resTrustStore);
    keyStoreFactoryBean.setPassword(security.decrypt(trustPassword));
    return keyStoreFactoryBean;
}

@Bean
public TrustManagersFactoryBean sessionTrustManagersFactoryBean() {
    TrustManagersFactoryBean trustManagersFactoryBean = new TrustManagersFactoryBean();
    trustManagersFactoryBean.setKeyStore(sessionTrustStore().getObject());

    return trustManagersFactoryBean;
}
}

The Keystore keeps the certificate I have extracted with Firefox from the Site. Do I need to set any additional Informationen for the Keystore? From my logs I can see, that the keystore is loaded successfully.

Answer 1

I don't think you should have "file:" here:

Resource resTrustStore = resourceLoader.getResource("file:" + trustStore);