5

I have to make callout to an external REST service from salesforce. Service provider has shared an 'HTTPS' endpoint with me.

I am able to access the service by simply pasting service endpoint in browser, and it returns a JSON response. But when I try to invoke same endpoint from Salesforce it does not work and gives below error:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I contacted my service provider and they mentioned that the service is working in browser because the browser trusts my service provider's certificate and similarly Salesforce should also trust the certificate.

I downloaded the certificate from the browser and tried to add it to callout as in Approach-1 and Approach-2 below. And also tried to add a salesforce self-signed certificate as in Approach-3 below. But every time I get the same error.

HttpRequest request = new HttpRequest();
String endpoint = 'https://serviceprovider.com/querystring';
request.setEndPoint(endpoint);

///Approach-1////
//String cert1 = 'certificate details';
//request.setClientCertificate(cert1,'password');

///Approach-2////
//String cert1 = 'certificate details';
//String cert2 = EncodingUtil.base64Encode(Blob.valueOf(cert1));
//request.setClientCertificate(cert2,'password');

///Approach-3////
request.setClientCertificateName('Testing');

request.setMethod('GET');
HttpResponse response = httpProtocol.send(request);
System.debug('######'+response.getBody());

Any help to resolve the issue will be appriciated. Thanks in advance.

  • We are thinking of doing the same thing. Did you get anywhere with this? – WorkToWindsurf Jul 11 '14 at 15:29
2

You may like to refer the previous discussion we had on this issue

Why do I get 'PKIX path building failed' exception with my callout?

This happened to me since site/service was not certified with an ssl certificate signed by some verified certificate authority (CA).

The following are the accepted SSL CA cerificates by salesforce

http://wiki.developerforce.com/page/Outbound_Messaging_SSL_CA_Certificates#thawteprimaryrootcag3

quick solution would be to ask the service provider to have valid SSL certifcate .

If the external system is Java client then refer the following discussion board to find resolution

http://boards.developerforce.com/t5/General-Development/PKIX-path-building-failed/td-p/128332

You may prefer advanced security using two way SSL and developer force documentation may assist you

http://wiki.developerforce.com/page/Making_Authenticated_Web_Service_Callouts_Using_Two-Way_SSL

Remember in two way SSL the client and server both need to have valid certificates.

Hence just making private certificate at your end may not solve the problem unless the server hosting the service has a valid SSL certificate.

  • Thanks Mohith!! I checked with my service provider. There is a chain of certificates Issuer: GeoTrust SSL CA -> Issuer: GeoTrust Global CA -> Issuer: GeoTrust Global CA 'GeoTrust Global CA' is there in salesforce's list. I again tried Approach-1 and Approach-2 with all the 3 certificates. But still no luck. Right now We are not considering two way SSL. I don't think there is any issue with service provider system, becuase I am able to get response in browser and SOAPUI. Still I will verify the suggestions mentioned in the thread on Monday. If you have any other suggestion please share. – V J Mar 9 '13 at 20:08
  • If your service provider is sure they have valid certificates,then make a callout without anything.please dont follow any of the approaches.Just have a direct callout. – Mohith Shrivastava Mar 10 '13 at 7:05
  • Already tried. it gives the same error. – V J Mar 10 '13 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.