Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have successfully generated a keystore using

keytool -genkeypair -alias SomeAlias -keyalg RSA -validity 365 -keystore NAME.keystore -storetype JKS

placed it in tomcat config dir and updated server.xml file enabling 8443 port listening.

So i can access https://localhost:8443/MyApp

But when i am trying to POST some data from https://localhost:8443/MyApp to https://localhost:8443/MyApp PKIX path building failed: unable to find valid certification path to requested target

my POST function:

    public void HttpsPostData(String data, URL url){
    try {
        String encodedData = URLEncoder.encode("data", "UTF-8") + "=" + URLEncoder.encode(data, "UTF-8");
        HttpsURLConnection con = (HttpsURLConnection)url.openConnection();

        OutputStreamWriter wr = new OutputStreamWriter(con.getOutputStream());

        BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));

        String inputLine;

        while ((inputLine = in.readLine()) != null)

    } catch (IOException ex) {
        Logger.getLogger(Sender.class.getName()).log(Level.SEVERE, null, ex);

what i am missing?

share|improve this question

You will have to trust the server certificate, even if it was localhost. Probably the easiest way is to use a Java application called InstallCert. See a blog post here.

Quick steps:

  1. Compile the with javac
  2. Call java InstallCert localhost:8443, trust the certificate and InstallCert will produce a file called jssecacerts.
  3. Copy jssecacerts to your JDK directory under the jre/lib/security directory.

and the program should be able to trust the certificate.

share|improve this answer
Is it possible to do it in runtime without touching java.home? – Eir Nym Nov 3 '11 at 13:32
@EirNym Apparently yes (see: I would only recommend this for testing purposes, because this basically makes the SSL useless. – miq Nov 3 '11 at 13:50
So I can easily make X509TrustManager with partial trust! – Eir Nym Nov 3 '11 at 13:59
@EirNym if you want to use a different truststore (other than cacerts in the JRE home directory), you can use the (and related) system properties. – Bruno Dec 27 '11 at 23:24
Bruno, thanks! it's very useful! – Eir Nym Dec 28 '11 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.