Java 'javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target': how do I fix it without disabling TLS checks?

Cause: The JVM could not build a chain from the server's certificate to a root it trusts. Java uses its own truststore, not the operating system's: by default the file named by javax.net.ssl.trustStore, otherwise jssecacerts if it exists, otherwise cacerts under the JDK's lib/security directory. Failures happen when the server uses a private or corporate CA, a TLS-inspecting proxy re-signs traffic, the server does not send the intermediate certificate, or the JDK's cacerts is old and lacks a newer root. Fix (best first): 1. Find out who issued the certificate (the issuer in the failing site's chain) and obtain the CA certificate from the owner or from IT, and compare its fingerprint with a trusted source. 2. Import that CA (not the server's leaf certificate, if you can avoid it) into the truststore the JVM actually uses: keytool -importcert -cacerts -alias my-company-ca -file my-company-ca.cer. The -cacerts option targets the JDK's default cacerts; the initial store password is documented as changeit, which administrators should change. Prefer -storepass:env or :file over typing passwords in shell history. 3. To avoid changing the JDK, create a separate truststore containing your CA and point to it with -Djavax.net.ssl.trustStore=/path/to/truststore and the matching trustStorePassword. Note this replaces the default store for that JVM, so include public roots too if the app also calls public sites. Keep the password out of the command line where possible, since other users can see it. 4. If the server omits its intermediate certificate, fix the server to send the full chain. 5. Update to a current JDK patch release so the bundled cacerts has current roots. Don't: install a trust-all TrustManager or a hostname verifier that accepts everything. That removes protection against interception for all connections made through it. Verify: Rerun the failing call; the handshake succeeds. keytool -list -cacerts -alias my-company-ca shows the entry. Sources: https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html