title: Java7 Refusing to trust certificate in trust store
body: <p>I've a weird problem - a supplier uses TLS SSLv3 with both a self signed client and server certificate. This hasn't been a problem with Java1.5 and Java1.6 - simply import client certificate and private key into a keystore and the server public certificate into the truststore.
  Everything works fine.
  However with Java7 the server certificate fails to be trusted even though the same truststore is being used. I've tried Windows and Red Hat both using Java7 (1.7.03, 04 and 05, x86 and x64 versions) with no success.</p>
  
  <p>I've recreated the keystore/truststore from scratch and they only contain these certificates.
  The appropriate system properties have been set (javax.net.ssl.keyStore, javax.net.ssl.trustStore) and the key aspect is that the exact same code and configuration runs perfectly in JDK5/6.</p>
  
  <p>I'm at a loss - I can't find any reference to additional checking but I would have thought that the fact the certificate was located in the truststore should mean that it's trusted regardless of being self signed.</p>
  
  <p>Any help appreciated.
  Ads</p>
  
  <p>Exception trace:</p>
  
  <pre><code>Exception in thread "main" javax.net.ssl.SSLHandshakeException:     sun.security.validator.ValidatorException: PKIX path validation failed:     java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
  sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
  at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
  at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1868)
  at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
  at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)
  at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1338)
  at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:154)
  at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
  at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
  at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:998)
  at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1294)
  at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:685)
  at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:111)
  at sun.nio.cs.StreamEncoder.writeBytes(StreamEncoder.java:221)
  at sun.nio.cs.StreamEncoder.implFlushBuffer(StreamEncoder.java:291)
  at sun.nio.cs.StreamEncoder.implFlush(StreamEncoder.java:295)
  at sun.nio.cs.StreamEncoder.flush(StreamEncoder.java:141)
  at java.io.OutputStreamWriter.flush(OutputStreamWriter.java:229)
  at com.alltria.ypsilon.testing.TestSSL.main(TestSSL.java:65)
  Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
  at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:350)
  at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:249)
  at sun.security.validator.Validator.validate(Validator.java:260)
  at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
  at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
  at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
  at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1320)
  ... 13 more
  Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
  at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:208)
  at java.security.cert.CertPathValidator.validate(CertPathValidator.java:279)
  at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:345)
  ... 19 more
  Java Result: 1
  </code></pre>
  
  <p>The part where the ssl debug fails is trying to validate the server certificate:</p>
  
  <pre><code>***
  %% Invalidated:  [Session-1, SSL_RSA_WITH_RC4_128_SHA]
  main, SEND SSLv3 ALERT:  fatal, description = certificate_unknown
  main, WRITE: SSLv3 Alert, length = 2
  [Raw write]: length = 7
  0000: 15 03 00 00 02 02 2E                               .......
  main, called closeSocket()
  main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
  main, called close()
  main, called closeInternal(true)
  </code></pre>