edu.yale.its.tp.cas.client.CASAuthenticationException:?Unable?to?validate?ProxyTicketValidator
[[edu.yale.its.tp.cas.client.ProxyTicketValidator?proxyList
=
[
null
]
[edu.yale.its.tp.cas.client.ServiceTicketValidator?casValidateUrl
=
[https:
//
sourcesite:8443/cas/proxyValidate]?ticket=[ST-0-UMjsI0YOhF15RhutnkHW]
service=[http%3A%2F%2Fdestsite%3A8080%2Fservlets-examples%2Fservlet%2FHelloWorldExample]
renew=false]]]
????at?edu.yale.its.tp.cas.client.CASReceipt.getReceipt(CASReceipt.java:
52
)
????at?edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:
455
)
????at?edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:
378
)
????at?org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
202
)
????at?org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
173
)
????at?filters.ExampleFilter.doFilter(ExampleFilter.java:
101
)
????at?org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:
202
)
????at?org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:
173
)
????at?org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:
213
)
????at?org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:
178
)
????at?org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:
432
)
????at?org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:
126
)
????at?org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:
105
)
????at?org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:
107
)
????at?org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:
148
)
????at?org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:
869
)
????at?org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:
664
)
????at?org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:
527
)
????at?org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:
80
)
????at?org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:
684
)
????at?java.lang.Thread.run(Thread.java:
595
)
Caused?by:?javax.net.ssl.SSLHandshakeException:?sun.security.validator.ValidatorException:?PKIX?path?building?failed:
sun.security.provider.certpath.SunCertPathBuilderException:?unable?to?find?valid?certification?path?to?requested?target
????at?com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:
150
)
????at?com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:
1476
)
????at?com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:
174
)
????at?com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:
168
)
????at?com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:
843
)
????at?com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:
106
)
????at?com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:
495
)
????at?com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:
433
)
????at?com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:
815
)
????at?com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:
1025
)
????at?com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:
1038
)
????at?sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:
405
)
????at?sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:
170
)
????at?sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:
905
)
????at?sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:
234
)
????at?edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java:
84
)
????at?edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java:
212
)
????at?edu.yale.its.tp.cas.client.CASReceipt.getReceipt(CASReceipt.java:
50
)
????
?
20
?more
Caused?by:?sun.security.validator.ValidatorException:
PKIX?path?building?failed:?sun.security.provider.certpath.SunCertPathBuilderException:
?unable?to?find?valid?certification?path?to?requested?target
????at?sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:
221
)
????at?sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:
145
)
????at?sun.security.validator.Validator.validate(Validator.java:
203
)
????at?com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:
172
)
????at?com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(SSLContextImpl.java:
320
)
????at?com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:
836
)
?????
33
?more
Caused?by:?sun.security.provider.certpath.SunCertPathBuilderException:?unable?to?find?valid?certification?path?to?requested?target
????at?sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:
236
)
????at?java.security.cert.CertPathBuilder.build(CertPathBuilder.java:
194
)
????at?sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:
216
)
?????
38
?more
這個原因發(fā)生在：在SSL握手中，CAS Client無法識別CAS Server的證書(X)，即無法建立一條從cacerts信任證書到X的信任路徑，
讀者可以看一個叫做PKIX規(guī)范。解決辦法是檢查tomcat使用的信任證書路徑，通常是jre/lib/security/cacerts文件，看是否已經(jīng)
導(dǎo)入了所需信任證書。