在取得connection的時候和正常瀏覽器訪問同樣，仍然會驗證服務端的證書是否被信任（權威機構發行或者被權威機構簽名）；若是服務端證書不被信任，則默認的實現就會有問題，通常來講，java在訪問ssl的連接時常常會報錯誤：html
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1591)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:975)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1107)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:405)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:133)
at com.wenhq.http.TestSSL.testAig(TestSSL.java:21)
at com.wenhq.http.TestSSL.main(TestSSL.java:13)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
at sun.security.validator.Validator.validate(Validator.java:218)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)
… 12 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)java
緣由就是缺乏信任的安全證書時出現的異常。chrome
客戶端在進行SSL鏈接時，JSSE將根據這個文件中的證書決定是否信任服務器端的證書。在SunJSSE中，有一個信任管理器類負責決定是否信任遠端的證書，這個類有以下的處理規則：
1)若系統屬性javax.net.sll.trustStore指定了TrustStore文件，那麼信任管理器就去jre安裝路徑下的lib/security/目錄中尋找並使用這個文件來檢查證書。
2)若該系統屬性沒有指定TrustStore文件，它就會去jre安裝路徑下尋找默認的TrustStore文件，這個文件的相對路徑爲：lib/security/jssecacerts。
3)若jssecacerts不存在，可是cacerts存在（它隨J2SDK一塊兒發行，含有數量有限的可信任的基本證書），那麼這個默認的TrustStore文件就是lib/security/cacerts。瀏覽器
能夠經過下面的方法給java增長信任證書：
一、從chrome瀏覽器中導出 證書的cer格式文件；安全
2.導入cer證書到java的證書信任庫
D:\Program Files\Java\jdk1.6.0_07\bin>keytool -import -keystore jssecacerts -file purchase.cer -alias purchase服務器
輸入keystore密碼：changeit
再次輸入新密碼:changeitide
keytool用法總結
三、把生成的 jssecacerts文件放到$Javahome\jdk1.6.0_07\jre\lib\security目錄下就能夠了。oop