0

My ecom website just began getting an error when it goes out to gather rate info from UPS. Any suggestions what I need to do to correct this SSL error?

The short error is:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The full stack is:

RateShopper - -error while attempting to connect to UPS for rate shopping <javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1591)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:975)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1107)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:405)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:133)
    at net.mydomhere.ups.RateShopper.getRatesFromZipAndWeight(RateShopper.java:148)
    at net.mydomhere.ups.servlet.RateShopServlet.doPost(RateShopServlet.java:60)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:247)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:243)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:566)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:472)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:943)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:190)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:566)
    at org.apache.catalina.valves.CertificatesValve.invoke(CertificatesValve.java:246)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:564)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:472)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:943)
    at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:2347)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:180)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:566)
    at org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatcherValve.java:170)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:564)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:170)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:564)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:468)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:564)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:472)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:943)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:174)
    at org.apache.catalina.core.StandardPipeline.invokeNext(StandardPipeline.java:566)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:472)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:943)
    at org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:1027)
    at org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:1125)
    at java.lang.Thread.run(Thread.java:619)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
    at sun.security.validator.Validator.validate(Validator.java:218)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)
    ... 44 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)

2 Answers 2

0

The solution was to change the URL for which you are calling UPS to gather rate information from ups.com to onlinetools.ups.com.

-1

We've also started receiving this error today for UPS label generation. I've contacted UPS regarding the issue. See comments below.

Here's the response from UPS:

UPS has upgraded the communication security protocols for all web-based applications, including UPS Developer Kit, UPS.com, CampusShip, and etcetera. Please contact your company's IT department or development team to ensure that any security protocols currently used meet the TLS 1.2 requirement. If Java is enabled, it must be version 1.7 or higher to use TLS 1.2.

As of October 10, 2017, 50% of all API servers have been transitioned over to ignore any traffic using TLS 1.0.

As of November 16, 2017, all old API URLs, which are those starting with www.ups.com/ups.app/xml/ are also transitioned to ignore all TLS 1.0 traffic.

Please ensure that you are posting the API request to correct URL address. This information can be found in the API documentation you download from UPS.com.

5
  • Thanks for the note - if you get an update, please share. If I find a solution I will update here as well.
    – MSF004
    Nov 16, 2017 at 21:13
  • I received a response from UPS regarding a final migration to TLSv1.2, which we're currently using so that wasn't much help. After checking the latest version of the API docs I noticed that the domain for the service we're accessing has changed from ups.com to onlinetools.ups.com. I wrote a simple class to connect to the new URL and I'm receiving a successful handshake, but haven't tested the new URL using a full POST against the service. I'm going to attempt a ShipConfim using the new production URL in our test environment.
    – guest
    Nov 16, 2017 at 21:51
  • Yes, I just changed my production machine to point to onlinetools.ups.com and everything is working again. Thank you!
    – MSF004
    Nov 16, 2017 at 22:59
  • This is more complicated than originally thought. It would seem that not all of UPS's servers have transitioned to TLSv1.2, and in fact - my test requests fail when routed to a v1.2 server. If you're currently setup to accept both then I would imagine you shouldn't experience further issues. As for me, it looks like I have a long night ahead of me.
    – guest
    Nov 17, 2017 at 0:10
  • 1
    In our case, we required a couple of additional steps. In addition to updating the service endpoints to use onlinetools.ups.com, we updated from HttpClient 3.1 to 4.5.3, set the "https.protocols" system property to "TLSv1.2,TLSv1.1,TLSv1" and used CloseableHttpClient client = HttpClientBuilder.create().useSystemProperties().build() in order to enable TLSv1.2 for HttpClient. Hope that helps if you find that you're receiving inconsistent SSL handshakes.
    – guest
    Nov 17, 2017 at 3:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .