Home/ Questions/Q 3276122
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T19:13:21+00:00

When running submissions ( <xforms:submission> ) over HTTPS against a server that use a

  • 0

When running submissions (<xforms:submission>) over HTTPS against a server that use a self-signed certificate, I am getting an exception in the logs that looks like:

ERROR XFormsServer  - XForms - submission - xforms-submit-error throwable: sun.security.provider.certpath.SunCertPathBuilderException 
: unable to find valid certification path to requested target 
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174) 
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238) 
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280) 
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)

How can I solve this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    When making the HTTPS request, Java checks the certificate of the server. Because the certificate is self-signed, Java can’t verify it is a legitimate certificate, hence the error message “unable to find valid certification path to requested target”.

    What you need to do is either:

    1. Use a “real” certificate (e.g. signed by Verisign).
    2. Add the certificate of your server to a “trust store”, and setup your JVM of application server use that trust store.

    The exact steps for doing #2 above will depend on your environment, but in essence:

    1. If the server handling the requests has its self-signed key in a Java key store, export it. Here your-server is the alias for your server the key store, mykey.cer is the file you are creating, keystore is your key store file, and your-password is the password to your key store.

      keytool -export -alias your-server -file mykey.cer -keystore keystore -storepass your-password

    2. On the server on which Orbeon Forms is running (i.e. the server that initiates the HTTPS request), import mykey.cer into a trust store. Here truststore is your trust store file, which might be a new file you are creating if you don’t have an existing trust store.

      keytool -import -v -trustcacerts -alias your-server -file mykey.cer -keystore truststore -storepass your-password

    3. Add the following -D parameters when starting the VM that runs your application server (e.g. Tomcat) and Orbeon Forms:

      -Djavax.net.ssl.trustStore=path/to/your/truststore -Djavax.net.ssl.trustStorePassword=your-password

    • 0