PKIX Error

Question

jdk 1.5.8
I am getting below error. I've tried importing the certificate in /usr/local/java/jre/lib/security/cacerts again even though it said that cert already exist. I also generated jssecert using InstallCert program on the web (http://blogs.sun.com/andreas/entry/no_more_unable_to_find) but nothing seems to be working. It's a verisign cert which is already there in cacert but still I am getting this error.
javax.naming.CommunicationException: simple bind failed: ldap.intuit.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
        at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:197)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2637)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:283)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFEdited by: mohitanchlia on Sep 23, 2009 3:37 PM
Edited by: mohitanchlia on Sep 23, 2009 3:38 PM

Answer 1

If you have not-yet-commons-ssl-0.3.11.jar on your classpath, and you don't mind rendering SSL essentially insecure and pointless, this works very nicely:
env.put("java.naming.ldap.factory.socket", LDAPSocket.class.getName());
LDAPSocket sock = LDAPSocket.getInstance();
sock.setCheckHostname(false);
sock.setCheckCRL(false);
sock.setCheckExpiry(false);
try {
sock.setTrustMaterial(TrustMaterial.TRUST_ALL);
} catch (Exception e) {
NamingException ne = new NamingException("Failed to set SSL to TRUST_ALL");
ne.setRootCause(e);
throw ne;
You can download the jar file from here:
[http://juliusdavies.ca/commons-ssl/download.html|http://juliusdavies.ca/commons-ssl/download.html]