Why am I getting the ValidatorException error when connecting to an SSL server?

You are getting a ValidatorException error when connecting to an SSL server, because the server certificate can not be trusted for one of the following possible reasons:

• The root CA of the server certificate is unknown.
• The server certificate has been expired.
• Many other reasons.

You can play with SslServerCmd.java and SslClientCmd.java given in previous tutorials to see the ValidatorException error:

1. Open a command window and run SslServerCmd.java on your local host:

\fyicenter>\local\jdk-1.8.0\bin\java SslServerCmd

USAGE: java SslServerCmd [port [clientAuth]]
Listening: port=8080, clientAuth=No

2. Open another command window and run SslClientCmd.java on your local host:

\fyicenter>\local\jdk-1.8.0\bin\java SslServerCmd

Exception in thread "main" javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException: PKIX path building failed: 
sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target
   at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
   at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1937)
...

In this case, the server certificate is signed by yourself as the root CA. The client program SslServerCmd.java cannot trust it, because the root CA in not listed in the default trusted root CA list.

Owner: CN=fyicenter.com, OU=IT, O=FYIcenter, L=NA, ST=NA, C=FR
Issuer: CN=fyicenter.com, OU=IT, O=FYIcenter, L=NA, ST=NA, C=FR

⇒ Make SSL Server Certificate Trusted

⇐ SslServerCmd.java - SSL Server Command Example

⇑ Examples for jsse.jar - Java Secure Socket Extension

⇑⇑ FAQ for jsse.jar - Java Secure Socket Extension