Digital Ocean SSLHandshakeException PKIX path building failed, unable to find valid certification path to requested target

We are getting this below exception when we hit our URL by Java class (as we are using Let’s Encrypt certificate). PKIX path building failed: unable to find valid certification path to requested target

As our server is at Digital Ocean and we created a docker container there. Our application is running inside docker container. we checked SSL things at digital Ocean by using below command and it connects successfully.
curl -k
curl --insecure -v 2>&1 | awk 'BEGIN { cert=0 } /^* Server certificate:/ { cert=1 } /^*/ { if (cert) print }'
We also used SSLPoke class and we are not getting any exception

java SSLPoke 443 It gives us
Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=cp1252
Successfully connected

My domain is:

My web server is (include version): Apache 2.4

The operating system my web server runs on is (include version): Debian 9.6

My Java is : openjdk version “1.8.0_111”

SSL Report Link (getting overall rating A) :

I can login to a root shell on my machine (yes or no, or I don’t know): yes

Can anyone help me over this exception? Any help would be appreciated.

Hi @cwa

I don't understand your error really. But checking your domain (via ) there is a problem:

Your certificate has only one domain name. (3653)
expires in 77 days - 1 entry

The result: Your non-www version

Domainname Http-Status redirect Sec. G 302 0.320 A 302 0.310 A 200 3.403 N
Certificate error: RemoteCertificateNameMismatch 200 3.103 B

isn't secure.

Create one certificate with both domain names (non-www and www) and use that. Then check if the error is gone.

If you check your www version with Ssllabs, all is good. Your non-www version doesn't work.

So if your Java connect the non www version, that doesn't work.

1 Like

Hi Juergen,
Thanks for quick response. We created one certificate with both domain names (non-www and www) and used that certificate, but still getting the same SSL Handshake issue.
Is there something which i am missing ?

Regards, cwa

Now your configuration is good:

Your certificate has both domain names:
expires in 90 days, - 2 entries

Both connections are secure.

There is a new SSLlabs check:

Is that Java 6u45 or older? If yes, perhaps the DH parameters are "too good".

Perhaps some Java libraries are too old.

Checked your non-www version

your DH parameters:

TLS_DHE_RSA_WITH_AES_256_CBC_SHA ( 0x39 ) DH 4096 bits FS

But the client doesn't support DH > 1024

Hi Juergen,

We are using JAVA version “1.8.0_181”. Sorry did not get the below line which you wrote
" But the client doesn’t support DH > 1024"

Please elaborate. where I am supposed to make changes to resolve this issue.

Regards, cwa

That's the oldest Java client SSLLabs checks.

But rereading your original message

it sounds that your java doesn't find the root. But I'm not familiar with java development.

Searching "SunCertPathBuilderException" there are some (old) samples how to check such a configuration.

Hi Juergen,
Thanks. Please let us know if you find anything.


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.