title: Adding a private CA to Openjdk11 cacerts
body: <p>I need to be able to use our private PKI CA to authenticate with a Java application.  Specifically, I need to be able to securely send email through our smart hub originating on a host running iDempiere.</p>
  <p>I am testing this using the SSLPoke class.</p>
  <pre><code>JAVA_VERSION=&quot;11&quot; java SSLPoke mx32.harte-lyne.ca 465
  sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  <p>My research indicates that this error is commonly encountered when the CA certificate for the destination host certificate is not found in the <code>lib/security/cacerts</code> file.</p>
  <p>I have added our private CA certs [hll] to <code>cacerts</code> and verified that they are present:</p>
  <pre><code>JAVA_VERSION=&quot;11&quot; keytool -list  -rfc  -cacerts &gt; cacerts.txt
  grep 'Alias' cacerts.txt
  . . .
  lias name: godaddyclass2ca [jdk]
  Alias name: godaddyrootg2ca [jdk]
  
  Alias name: hartelyneissuer2016 [hll]
  Alias name: hartelyneroot2016 [hll]
  
  Alias name: identrustcommercial [jdk]
  Alias name: identrustdstx3 [jdk]
  . . .
  </code></pre>
  <p>And yet, when I test this using the <code>SSLPoke</code> class I get this error:</p>
  <pre><code>JAVA_VERSION=&quot;11&quot; java SSLPoke mx32.harte-lyne.ca 465
  sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
      at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:369)
  </code></pre>
  <p>What else is required to get our CA certs to be recognised by Java?</p>