Adding StartCom CA Cert to JDK 1.7.0 on Mac OS X to access FYB-SE API

I tried to access the Bitcoin exchange FYB-SE's API using a Java program under JDK 1.7.0 on Mac OS X 10.9.4. I got an exception:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The reason is that FYB-SE's https SSL security certificate was issued by the Israeli certificate authority StartCom, whose Certificate authority (CA) certificate is not listed in Java's database of trusted certificate authorities.

My fix was to download Smartcom's CA certificate from http://www.startssl.com/certs/ca.crt. Then I did the following:

cd /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home/jre/lib/security/
cp cacerts cacerts.orig
sudo keytool -importcert -file ~/certs/ca.crt -keystore cacerts

After this, my Java program trusted the certificate, and got stuck at the next error instead ;-)

Did you find this useful? Please Flattr me!