我们正在使用Spring Integration连接到https / ssl外部系统。使用外部主机和端口443添加证书后，从端口检索。证书存在。
但是应用程序仍然失败
> ERROR 2886 --- [ebContainer : 1] c.i.w.w.servlet.ServletWrapper : SRVE0014E: Uncaught service() exception root cause
> dispatcherServlet:
> org.springframework.web.util.NestedServletException: Request
> processing failed; nested exception is
> org.springframework.ws.client.WebServiceIOException: I/O error:
> com.ibm.jsse2.util.h: PKIX path building failed:
> java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl
> could not build a valid CertPath.; internal cause is:
> java.security.cert.CertPathValidatorException: The certificate issued by CN=ODC somest Root CA - G1, O=ODC sonst, C=TR is
> not trusted; internal cause is:
> java.security.cert.CertPathValidatorException: Certificate chaining error; nested exception is
> javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path
> building failed: java.security.cert.CertPathBuilderException:
> PKIXCertPathBuilderImpl could not build a valid CertPath.; internal
> cause is:
> java.security.cert.CertPathValidatorException: The certificate issued by CN=ODC somest Root CA - G1, O=ODC sonst, C=PR is
> not trusted; internal cause is:
> java.security.cert.CertPathValidatorException: Certificate chaining error
如果我运行keytool并将证书导入cacert，则应用程序可以正常运行。但是维护团队不接受此解决方案，因为它没有出现在websphere控制台中。在Spring集成请求中有什么我可以改变的吗所以我可以请任何人帮助我理解问题和修复。
UPDATE
/ srv / opt / IBM / WebSphere / AppServer / java / bin / keytool -list -v -keystore /srv/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/K1Node01Cell/nodes/K1Node01/trust.p12 -storepass WebAS -storetype PKCS12
显示证书条目...不确定如何确认它是完整还是不正确
题：
应该从端口更新cacert文件中检索？ cacert在websphere jre安全性中，而trust.p12在profile /../ nodes内
更新2：
我已启用跟踪并查看下面的日志。是春天试图调查cacerts ......或者这是正常的，因为它是WebSphere使用的JRE的一部分
> [18-2-19 13:44:59:154 ] 00000063 SystemOut O 2019-02-18
> 13:44:59.153 INFO 30426 --- [ver.startup : 0]
> pertySourcedRequestMappingHandlerMapping : Mapped URL path
> [/v2/api-docs] onto method [public
> org.springframework.http.ResponseEntity<springfox.documentation.spring.web.json.Json>
> springfox.documentation.swagger2.web.Swagger2Controller.getDocumentation(java.lang.String,javax.servlet.http.HttpServletRequest)]
> [18-2-19 13:44:59:826 ] 00000063 SystemOut O keyStore is:
> /srv/opt/IBM/WebSphere/AppServer/java/8.0/jre/lib/security/cacerts
> [18-2-19 13:44:59:826 ] 00000063 SystemOut O keyStore type is: jks
> [18-2-19 13:44:59:827 ] 00000063 SystemOut O keyStore provider is:
> [18-2-19 13:44:59:827 ] 00000063 SystemOut O init keystore
> [18-2-19 13:44:59:906 ] 00000063 SystemOut O SSLContextImpl:
> Using X509ExtendedKeyManager com.ibm.jsse2.ay [18-2-19 13:44:59:908 ]
> 00000063 SystemOut O trustStore is:
> /srv/opt/IBM/WebSphere/AppServer/java/8.0/jre/lib/security/cacerts
回答你的最后一个问题，不，从港口检索不应该更新cacerts。它应该像你提到的trust.p12文件一样更新一个文件。
但是，您的路径表明您确实拥有ND环境，包含单元格和节点。并且您已导入NodeDefaultTrustStore。我们总是导入CellDefaultTrustStore。你可以试试吗？