Getting PKIX path build failure for aws com.amazonaws.SdkClientException

user_12378178 0
Viewed 7953

While I am trying to upload an object to the S3 bucket from java using Eclipse. I am getting below exception

com.amazonaws.SdkClientException: Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Please refer the link from which I have taken and execute the sample code

https://docs.aws.amazon.com/AmazonS3/latest/dev/UploadingObjects.html

Any help on this will be appriciated.

amazon-web-services sdk amazon-s3 java
2 Answers
user_138124600

I faced the same issue with Eclipse with AWS Java SDK 2 to execute the AWS Java SDK sample codes from AWS SDK documentation. Here are the things I found. Newer Java versions have Amazon Root CA already in JDK truststore.

After troubleshooting the Application with with Parameter -Djavax.net.debug=all, or -Djavax.net.debug=ssl by passing vmargs in Run configurations, it was throwing an exception from the Intermediate Root CA from ZScalar certificate. JDK truststore does not have that Intermediate Root CA.

Then I went to ZScaler website to download their root, and intermediate CA from the URL. Here are the certificates that I downloaded. Add them to JDK truststore using the following command.

I have added root as well intermediate CA certificates from ZScaler, and then Eclipse Java Application with AWS Java SDK worked well without giving any errors.

Summary is: Sometimes the problem is with Intermediate Root CAs that are not added to JDK trust store by default.

keytool -import -alias zscaler-int-ca1 -file zscaler-ca1.cer -keystore $JAVA_HOME/lib/jre/security/cacerts

keytool -import -alias zscaler-root-ca1 -file zscaler-ca2.cer -keystore $JAVA_HOME/lib/jre/security/cacerts

Zscaler website URL to get CA

user_193771140
Related