Unit Testing HTTPS Clients with a Self-signed Certificate

Overview

A quick and easy way to eliminate javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target without making dangerous changes to your default trust store.

Steps

1. Create a new keystore and associated key entry by executing the following command (N.B. The password values for the -keypass and -storepass options must be identical for Tomcat to work):

   keytool -genkey -alias tomcat -keyalg RSA -keypass <password> -keystore <user-home>/tomcat.jks -storepass <password>
   

2. Enter and confirm your details.
3. Uncomment the “SSL HTTP/1.1 Connector” entry in $CATALINA_BASE/conf/server.xml.
4. Add keystoreFile and keystorePass attributes with the appropriate values. The result should now resemble the following:

   <!-- Define a SSL HTTP/1.1 Connector on port 8443
   	This connector uses the JSSE configuration, when using APR, the
   	connector should be using the OpenSSL style configuration
   	described in the APR documentation -->
   
   <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
   	maxThreads="150" scheme="https" secure="true"
   	keystoreFile="${user.home}/tomcat.jks" keystorePass="<password>"
   	clientAuth="false" sslProtocol="TLS" />
   

5. Restart Tomcat and deploy your HTTPS constrained resources.
6. Add a @BeforeClass method to any tests generating HTTPS requests. Use this method to set the javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword system properties. For example:

   @BeforeClass
   public static void setUp() {
   	System.setProperty("javax.net.ssl.trustStore", "<user-home>/tomcat.jks");
   	System.setProperty("javax.net.ssl.trustStorePassword", "<password>");
   }
   

7. JSSE now uses the new keystore created in steps 1 and 2 as opposed to the default, <java-home>/jre/lib/security/cacerts, trust store.