Home/ Questions/Q 8640715
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T11:20:50+00:00

I’m using tomcat 6 (embedded server) in myEclipse 10.0 along with Apache CXF for

  • 0

I’m using tomcat 6 (embedded server) in myEclipse 10.0 along with Apache CXF for a web services app. My problem is I’m trying to connect to a server that has a war file with some service code in it. However, when I try to hit it though the code, I’m getting this error from CXF:

WARNING: Interceptor has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Could not send Message.

and then this error which seems to be the root problem:

Caused by: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target

I used InstallCert.java to hit the server and it gave me this:

Loading KeyStore jssecacerts… Opening connection to :443…
Starting SSL handshake…

No errors, certificate is already trusted

I used Porticle to view the cacerts file and sure enough the server sha1 and md5 information matched exactly what was on the server. The cacerts file is located under the java/jre6/lib/security folder, which I thought was automatically picked up by tomcat when it loads.

I also created a .bin folder as another idea and put it under webapps directory for tomcat and modified the server xml like so:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
               keystoreFile="<path on my machine>/webapps/tomcat.bin" keystorePass="changeit" />

I found some articles that showed how to get the certificate loaded to your keystore, but that doesn’t seem to be the issue, even though that is the common solution for this error. Is there something I’m missing or could there be another reason why I’m getting this error?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It turned out that myEclipse has it’s own jre running it’s own default cacerts file. On my machine it was here: C:\MyEclipse\Common\binary\com.sun.java.jdk.win32.x86_1.6.0.013\jre\lib\security.

    I used ProcessExplorer to view the javaw.exe process and then did a Find (control key + F key) and it showed the additional jre that had loaded. I copied the correct cacerts over to that directory restarted everything and it worked!

    • 0