SSLHandshakeException: PKIX path building failed (Unable to find valid certification path)

Q: Import the certificate into Java Keystore

When to use: Use this when calling an internal corporate API with a self-signed certificate.. Java maintains a truststore (cacerts). If the target server's certificate isn't in it, Java rejects the connection. Use the keytool command to add it.

Q: Disable SSL Verification (Development Only)

When to use: Use this ONLY for local testing. NEVER in production.. Configure your RestTemplate or WebClient to trust all certificates, ignoring the SSL handshake.

Q: Ensure system clock is correct

When to use: Use this if the certificate is valid and imported, but the error persists.. SSL certificates have 'Not Before' and 'Not After' dates. If your server's clock is out of sync, Java might think the certificate is expired or not yet valid.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

2026-03-01 16:10:40.100 ERROR 8842 --- [nio-8080-exec-1] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://api.example.com": PKIX path building failed: unable to find valid certification path to requested target] with root cause

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

⚡ Quick Fix Works 80% of the time

Add the target server's SSL certificate to your Java keystore, or bypass SSL verification (DEV ONLY).

keytool -import -alias mycert -file cert.cer -keystore cacerts

🧠 Why this Happens

Tap to expand the deep technical explanation

Your Spring Boot application made an HTTPS request to an external server. During the SSL handshake, Java checked the server's certificate against its local truststore (cacerts). It couldn't find a matching trusted certificate, so it aborted the connection to prevent a man-in-the-middle attack.

The HITEC City Parking Spot Analogy:

Imagine a border guard checking a passport. The passport (Certificate) looks fine, but it wasn't issued by a country the guard recognizes (Truststore). The guard refuses entry.

🔁 How to Reproduce Confirm this is your error

Point RestTemplate at an HTTPS endpoint whose certificate is not trusted (for example a self-signed cert), then call it. Java throws SSLHandshakeException: PKIX path building failed.

🛠️ Solutions (3 Ways to Fix)

Solution 1✓ Most common cause

Import the certificate into Java Keystore

👉 Use this when calling an internal corporate API with a self-signed certificate.

Java maintains a truststore (cacerts). If the target server's certificate isn't in it, Java rejects the connection. Use the keytool command to add it.

# 1. Download the certificate from your browser (Save as cert.cer)
# 2. Add it to Java's keystore
keytool -import -alias myapi -file cert.cer -keystore $JAVA_HOME/lib/security/cacerts
# Default password: changeit

Solution 2

Disable SSL Verification (Development Only)

👉 Use this ONLY for local testing. NEVER in production.

Configure your RestTemplate or WebClient to trust all certificates, ignoring the SSL handshake.

// WARNING: DANGEROUS IN PRODUCTION
RestTemplate restTemplate = new RestTemplate();
// Use HttpClient that accepts all certs
// (Requires Apache HttpClient or custom SSLContext)

Solution 3

Ensure system clock is correct

👉 Use this if the certificate is valid and imported, but the error persists.

SSL certificates have 'Not Before' and 'Not After' dates. If your server's clock is out of sync, Java might think the certificate is expired or not yet valid.

# Linux: Sync time
sudo ntpdate ntp.ubuntu.com

# Windows: Sync time
w32tm /resync

📋 Version Notes

Spring Boot 2.x

Uses Java 8/11 SSL stack.

Spring Boot 3.x

Uses Java 17+ SSL stack, stricter on SNI and TLS 1.3.

🛡️ How to Prevent This Next Time

For internal corporate APIs, ensure the root CA certificate is distributed to all Docker images or servers running the Spring Boot app.