Search code examples
spring-bootssltomcat

Error: unable to verify the first certificate - Springboot

I have written a restful API project which is developed using spring boot and I am using the embedded tomcat and running a jar on a linux server.

The APIs are live at:

  https://api.arevogroup.com:8089/api/regions

and I can see the verified and correct SSL as well as in the given screenshot. enter image description here

but I am getting an this exception in the postman when I call these apis. enter image description here

These APIs are consumed by a Xamrin based app which seems to work all good when consumed using iPhone but gives this same exception when the APIs are accessed via android.

I guess, the way I have generated the ssl certificate has some issues.

I have used a pfx file and my SSL config in properties file looks like this:

###SSL Key Info
security.require-ssl=true
server.ssl.key-store-password=PASSWORD
server.ssl.key-store=classpath:ssl_pfx.pfx
server.ssl.key-store-type=PKCS12
  1. I have 2 questions, if disable the ssl verification, would the communication still be encrypted or not? (man in the middle attack is still possible but the info will still be encrypted, right?).
  2. If not, how can I fix this?
Solution 
  • security.require-ssl=true
server.ssl.key-store-password=PASSWORD
server.ssl.key-store=keystore.jks
server.ssl.key-store-provider=SUN
server.ssl.key-store-type=JKS

    Used the jks file instead of pfx and it worked all good. Thought to share with others too.