New Webinar: Govern roles, shares, and data movement in Snowflake

Learn how to govern Snowflake roles, shares, and data movement without slowing delivery. Join our live webinar on controlling drift, permissions, and audit readiness.

Save your spot

PKIX path building failed remedy

Last updated: September 2, 2025

You may encounter the error code "PKIX path building failed" if you are using Liquibase MongoDB Pro with Amazon DocumentDB TLS/SSL Configuration alongside the AWS extension or the individual AWS Secrets Manager Extension. This is caused by a lack of required certificates in your custom Java Truststore. Follow the guide below to resolve the error.

Error

Unexpected error running Liquibase: Unable to execute HTTP request: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Remedy

  1. Enter this command into the CLI to create a new combined truststore from your default Java CAcerts:

    Linux syntax:

    keytool -importkeystore -srckeystore "$JAVA_HOME/lib/security/cacerts" -srcstorepass changeit -destkeystore s3-docdb-combined-truststore.jks -deststorepass MyCombinedPassword -noprompt

    Windows syntax:

    keytool -importkeystore -srckeystore "%JAVA_HOME%\lib\security\cacerts" -srcstorepass changeit -destkeystore s3-docdb-combined-truststore.jks -deststorepass MyCombinedPassword -noprompt

  2. Copy the new truststore to the same directory as your existing truststore used for Amazon DocumentDB TLS/SSL. In this example, we will copy the new s3-docdb-combined-truststore.jks to the location of rds-truststore.jks.

  3. Run this command to merge the contents of both truststores into one.

    keytool -importkeystore -srckeystore rds-truststore.jks -srcstorepass SOME_PASSWORD -destkeystore s3-docdb-combined-truststore.jks -deststorepass MyCombinedPassword

  4. Run this command to set the JAVA_OPTS Environment Variable for Liquibase to recognize the new truststore:

    Linux syntax:

    export JAVA_OPTS="-Djavax.net.ssl.trustStore=ABSOLUTE_PATH_TO_TRUSTSTORE/s3-docdb-combined-truststore.jks -Djavax.net.ssl.trustStorePassword=MyCombinedPassword"

    Windows syntax:

    set JAVA_OPTS=-Djavax.net.ssl.trustStore=C:\path\to\s3-docdb-combined-truststore.jks -Djavax.net.ssl.trustStorePassword=MyCombinedPassword