Skip to content
MtrXTools

PKIX path building failed

Java can't build a trusted certificate chain

Seen in Java (javax.net.ssl.SSLHandshakeException), Maven, Gradle, Spring, Jenkins

Java could not link the server certificate to any CA in its truststore (cacerts).

Common causes

  • A corporate proxy or private CA that is not in the JDK cacerts file.
  • The server omits its intermediate certificate; Java does not fetch missing intermediates by default.
  • An old JDK whose cacerts lacks newer root CAs.
  • The app uses a custom truststore (javax.net.ssl.trustStore) that lacks the CA.

How to fix it

  1. Import the CA: keytool -importcert -cacerts -alias corp-ca -file ca.crt (Java 9+; default password changeit).
  2. Fix the server to send the full chain.
  3. Update the JDK to get a current cacerts.
  4. Check which JDK and truststore the app actually uses (java -XshowSettings:properties -version).
Check whether the chain is complete

Got a different message? Paste it into the error explainer.

Related errors

All 32 Languages & runtimes errors