We are using a CA-signed certificate for portal but recently another company acquired the company that authorized our web address and now there are some updates made to the certificate. As per the technical team who issues the certificates "All existing certificates will remain active and trusted until the end of their validity period" but we are experiencing the following issue:

System.CalloutException: IO Exception: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Later, i was asked if anyone removed the root and intermediate certificates which i don't know how to. Did anyone experience similarissue and got it resolved somehow?

  • 1
    Its not SF issue, the 3rd party you are calling has not configured the cert correctly. – Pranay Jaiswal Feb 13 '19 at 21:07

I don't think that Salesforce is the issue here, at least not according to the description of the problem that you've given so far.

To me, it sounds like Salesforce is trying to make a callout to your portal (i.e. Salesforce is initiating the connection).

If you're using https for your portal (which I hope you are), then you have an SSL Certificate. Salesforce needs to be able to say "Yes, this certificate is valid, and it is verified by someone that we trust".

Most certificate providers give you a certificate which is signed by an "intermediate cert". Basically, a layer of abstraction. The CA (Certificate Authority) has a root cert, which is used to sign some intermediate certs, which in turn is used to sign your cert.

This establishes a chain

Your cert => intermediate cert => root cert

Salesforce trusts the root cert (rather than the intermediate certs), and the onus is on your server to provide the path from your cert, all the way back to the (trusted) root cert.

This is where your error comes into play.

unable to find valid certification path to requested target

This means that Salesforce is unable to follow the chain from your cert, all the way back to the root cert. In the instance of this problem that I ran into, my company's server was missing the intermediate cert.

The thing that you'll (or someone will) be needing to do is called "Certificate Chaining". That's out of the scope of this site though. Get the certificate chain set up properly, and this issue should be resolved.

| improve this answer | |
  • Thanks for the information. I am checking with my internal team on doing the same. – SunnyG Feb 13 '19 at 22:03

You can find details on the certificate authority (CA) certificates that Salesforce trusts for outbound callouts in Know more about all the SSL certificates that are supported by Salesforce.


Salesforce trusts only root certificate authority (CA) certificates, with few historical exceptions. Salesforce's certificate trust policy is to require server and client certificate chains to include all intermediate certificates that exist between the server or client certificate and the chain's root certificate. Salesforce will not honor requests to add intermediate certificates to its trust list. Salesforce trusts many generally trusted root certificates, but not all.

To review a current list of supported certificates you can append /cacerts.jsp to any instance URL (Only Winter '19 Instances will work with this endpoint) - https://INSTANCE.salesforce.com/cacerts.jsp (replace 'INSTANCE' with any Winter'19 upgraded instance, e.g. https://cs32.salesforce.com/cacerts.jsp )

Once you are signed into your Salesforce org try replacing the URL path with /cacerts.jsp. Your hosting provider would need to use a cert signed by one of those root CAs.

| improve this answer | |
  • 1
    Thank you. I just checked the list i see UserTrust CA in there :| – SunnyG Feb 13 '19 at 21:27
  • 1
    Turns out that the company (Sectigo) which acquired COMODO is not in the list of trusted CAs. I have opened a ticket with Salesforce. Hope that resolves the issue. Thank you – SunnyG Feb 14 '19 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.