Home/ Questions/Q 7411429
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T06:23:07+00:00

I’m building an application that needs to open self-signed HTTPS SSL URLs in java.

  • 0

I’m building an application that needs to open self-signed HTTPS SSL URLs in java. I’ve learned that you can bypass the SSL problems by adding a call to HttpsURLConnection.setDefaultHostnameVerifier() where you say what hostnames are allowed.

However, I have a second problem where my servers are running self-signed certs. So even with the hostname bypass I’m getting exceptions like:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I’ve looked around and the only solutions I’ve found is to add the certificate to the java key store, but this is a problem for me because I have no control over when or how they update java, and I’ve read that the keystore isn’t preserved between updates, and I have no access to the system outside of the JVM.

My application will only make calls to a single server so if there was a way to bypass the self-signed restrictions, and never consult keystores, it wouldn’t be a security problem, but is there a way to do this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m building an application that needs to open self-signed HTTPS SSL
    URLs in java. I’ve learned that you can bypass the SSL problems by
    adding a call to HttpsURLConnection.setDefaultHostnameVerifier() where
    you say what hostnames are allowed.

    There are some misconceptions from your question:
    Hostname verification is unrelated to whether the certificate is self-signed or not.
    It is a verification that matches the domain you are trying to access with the certificate info (CN or Subject Alt Name).

    You would need to configure the verifier if you needed to accept a certificate that did not match the url (not recommended at all!!!)

    Concerning the self-signed.
    This is irrelevant.
    You can configure your application to load your custom truststore which would include the certificate your application will trust. In fact this is the best approach (than using Java’s cacerts).
    All you have to do is import the certificate in a keystore (JKS or PKCS12) and load it in your custom TrustManagers in your application.
    Just google arround, plenty of examples E.g. self-signed-ssl

    • 0