Installing root and intermediate certificates in java keystore

Issue faced:

java software could not validate that the server certificate is correct. This exception is thrown:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

Issue in details

Default java validation mechanism:

Checking certificate validity via CRL with openssl


openssl verify -crl_check -CAfile yoursite-root-ca-c.crt -untrusted signer-ca-c3-chain.crt https-yoursite.com.chain.crt


Checking certificate validity via OCSP with OpenSSL

The certificate have to had a OCSP definition.


openssl
OpenSSL>
OpenSSL> ocsp -issuer G:\temp\1\XXXRootCA.pem -cert G:\temp\1\XXXRootCA.pem -CAfile G:\temp\1\XXXRootCA.pem -url http://ocsp.myserver.com:80 -text


Note: add full path to the files

Connecting to HTTPS site with specific certificate in PHP

Here is an example how you could connect to a server, which requires that you identify yourself with a certificate.
Your certificate and the server certificate are signed by an authority whose certificate is in ca.ctr.