title: Still hitting certificate error after configure mobileFirst keystore
body: <p>Good day,</p>
  
  <p>I have a MobileFirst Server, that will call to my bankend appliction (ip address: 10.8.1.46).</p>
  
  <p>Its work currently as I am connected to http backend application.</p>
  
  <p>I would like to change it to connect to <code>https</code>.</p>
  
  <p>The following is the step I have done:</p>
  
  <ol>
  <li><p>Log in to bakend server, run the following command to generate the keystore:</p>
  
  <p>keytool -genkey -alias backend -keyalg RSA -validity 365 -keystore backend.jks -storetype JKS</p></li>
  </ol>
  
  <p>It prompt to key in keystore password, first name and last name and the other info.
  For first name and last name, I key in <code>10.8.1.46</code></p>
  
  <ol start="2">
  <li><p>I run the following command to export the <code>crt</code> file"</p>
  
  <p>keytool -export -alias backend -keystore backend.keystore -rfc -file backend.crt</p></li>
  <li><p>I copy this <code>backend.crt</code> to my <code>mfp</code> server. In my mfp server, I also create a keystore, by following command:</p>
  
  <p>keytool -keystore mfp.jks -genkey -alias mfp -keyalg RSA</p></li>
  <li><p>I run the following command to import the backend cert to mfp keystore.</p>
  
  <p>keytool -import -alias backend -file backend.crt -storetype JKS -keystore mfp.jks</p></li>
  <li><p>I run the keytool command to verify the cert is inside the keystore or not, and yes, its inside.</p>
  
  <p>keytool -list -keystore mfp.jks</p></li>
  <li><p>Next, I go edit mfp server <code>server.xml</code>, I update the keystore tag as follow:</p>
  
  <p><code>&lt;keyStore id="defaultKeyStore" location="/opt/IBM/libertyCore/usr/servers/mfp1/resources/security/mfp.jks" password="pass123" type="jks" /&gt;</code></p></li>
  <li><p>And I added in the <code>&lt;connectivity&gt;</code> tag in my adapter.xml:</p></li>
  </ol>
  
  <p>
  </p>
  
  <pre><code>&lt;displayName&gt;MyAdapter&lt;/displayName&gt;
  &lt;description&gt;MyAdapter&lt;/description&gt;
  
  &lt;connectivity&gt;
      &lt;connectionPolicy xsi:type="http:HTTPConnectionPolicyType"&gt;
          &lt;protocol&gt;https&lt;/protocol&gt;
          &lt;domain&gt;10.8.1.46&lt;/domain&gt;
          &lt;port&gt;8443&lt;/port&gt;
          &lt;sslCertificateAlias&gt;mfp&lt;/sslCertificateAlias&gt; 
          &lt;sslCertificatePassword&gt;pass123&lt;/sslCertificatePassword&gt;    
      &lt;/connectionPolicy&gt;
  &lt;/connectivity&gt;
  
  &lt;JAXRSApplicationClass&gt;c.c.i.mobile.MyAdapterApplication&lt;/JAXRSApplicationClass&gt;
  
  &lt;property name="rest.api.base.url" defaultValue="https://10.8.1.46:8443/api/v1" description="REST API Base URL" /&gt;
  
  &lt;property name="rest.api.connection.request.timeout" defaultValue="4000" description="REST API Connection Request Timeout (miliseconds)" /&gt;
  
  &lt;property name="rest.api.connect.timeout" defaultValue="10000" description="REST API Connect Timeout (miliseconds)" /&gt;
  
  &lt;property name="rest.api.socket.timeout" defaultValue="50000" description="REST API Socket Timeout (miliseconds)" /&gt;
  
  &lt;securityCheckDefinition name="UserAuthentication" class="c.c.i.mobile.authentication.UserAuthentication"&gt;
  
      &lt;property name="maxAttempts" defaultValue="3" description="How many attempts are allowed"/&gt;
  
  &lt;/securityCheckDefinition&gt;
  </code></pre>
  
  <p></p>
  
  <ol start="8">
  <li>restart mfp server.</li>
  </ol>
  
  <p>However, I am still hitting certificate error when fire request to https backend service.</p>
  
  <pre><code>[2/20/20 18:56:37:900 MYT] 0000008c c.c.i.mobile.resources.GeneralResource                  I &gt;&gt;&gt; initialize
  [2/20/20 18:56:37:906 MYT] 0000008c c.c.i.mobile.client.RestClient                          E client fail to execute REST
  javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
          at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
          at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
          at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
          at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
          at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
          at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
          at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
          at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
          at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
          at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:374)
          at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
          at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
          at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
          at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
          at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
          at com.cv.ibs.mobile.client.RestClient.execute(RestClient.java:55)
          at com.cv.ibs.mobile.resources.BaseResource.requestForPost(BaseResource.java:47)
          at com.cv.ibs.mobile.resources.GeneralResource.initialize(GeneralResource.java:39)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:498)
          at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:181)
          at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:97)
          at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200)
          at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:99)
          at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)
          at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)
          at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
          at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
          at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:251)
          at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)
          at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)
          at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)
          at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:171)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:293)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:212)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:595)
          at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:268)
          at com.ibm.mfp.server.java.adapter.shared.JAXRSSandbox$3.doFilter(JAXRSSandbox.java:579)
          at com.ibm.mfp.server.java.adapter.shared.FilterChainImpl.doFilter(FilterChainImpl.java:86)
          at com.ibm.mfp.server.java.adapter.shared.JAXRSSandbox.handleRequest(JAXRSSandbox.java:584)
          at com.ibm.mfp.server.java.adapter.internal.rest.AdaptersEndpoint.adapterServing(AdaptersEndpoint.java:123)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:498)
          at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)
          at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:137)
          at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
          at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:776)
          at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:705)
          at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
          at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
          at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
          at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:966)
          at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:868)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:595)
          at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:842)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:668)
          at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1285)
          at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:776)
          at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:473)
          at com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(WebAppFilterChain.java:135)
          at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:74)
          at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:978)
          at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1100)
          at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:81)
          at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:912)
          at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.run(DynamicVirtualHost.java:262)
          at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink$TaskWrapper.run(HttpDispatcherLink.java:955)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
          at java.lang.Thread.run(Thread.java:748)
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
          at sun.security.validator.Validator.validate(Validator.java:260)
          at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
          at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
          at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
          at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
          ... 77 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
          at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
          ... 83 more
  </code></pre>
  
  <p>But if go to MFP Console to change the url back to http, its still work.</p>
  
  <p>Is there any steps I miss?</p>