CAS做SSO报告的异常，请高手帮帮小忙


报告异常的JSP页面：
HTTP Status 500 - javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target--------------------------------------------------------------------------------type Exception reportmessage javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetdescription The server encountered an internal error that prevented it from fulfilling this request.exception javax.servlet.ServletException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:254)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)
root cause javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1520)
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:182)
com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:176)
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:975)
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:511)
com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:449)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:817)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1029)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1056)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1040)
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:405)
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:981)
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java:70)
edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java:212)
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:219)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)
root cause sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
sun.security.validator.Validator.validate(Validator.java:218)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:511)
com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:449)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:817)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1029)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1056)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1040)
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:405)
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:981)
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java:70)
edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java:212)
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:219)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)
root cause sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
sun.security.validator.Validator.validate(Validator.java:218)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:511)
com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:449)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:817)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1029)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1056)
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1040)
sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:405)
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:981)
sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
edu.yale.its.tp.cas.util.SecureURL.retrieve(SecureURL.java:70)
edu.yale.its.tp.cas.client.ServiceTicketValidator.validate(ServiceTicketValidator.java:212)
edu.yale.its.tp.cas.client.filter.CASFilter.getAuthenticatedUser(CASFilter.java:219)
edu.yale.its.tp.cas.client.filter.CASFilter.doFilter(CASFilter.java:184)
note The full stack trace of the root cause is available in the Apache Tomcat/6.0.37 logs.
证书生成没有问题
Tomcat的配置：目录：C:\Program Files (x86)\Apache Software Foundation\Tomcat 6.0\conf
 <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
         Java AJP  Connector: /docs/config/ajp.html
         APR (HTTP/AJP) Connector: /docs/apr.html
         Define a non-SSL HTTP/1.1 Connector on port 8080
    -->
    <Connector port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />
   <!--自己配置的SSL-->
    <Connector protocol="org.apache.coyote.http11.Http11Protocol" 
   port="8443" minSpareThreads="5" maxSpareThreads="75" 
   enableLookups="true" disableUploadTimeout="true" 
   acceptCount="100"  maxThreads="200" 
   scheme="https" secure="true" SSLEnabled="true" 
   keystoreFile="C:/Users/Administrator/.keystore" keystorePass="changeit" 
   truststoreFile="C:/Program Files (x86)/Java/jre1.6.0/lib/security/cacerts" 
   clientAuth="false" sslProtocol="TLS"/>    <!-- A "Connector" using the shared thread pool-->
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />
    -->           
目录：
C:\Program Files (x86)\Apache Software Foundation\Tomcat 6.0\webapps\examples\WEB-INF\web.xml
<filter>
<filter-name>CAS Filter</filter-name>
<filter-class>edu.yale.its.tp.cas.client.filter.CASFilter</filter-class>
<init-param>
  <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
  <param-value>https://localhost:8443/cas/login</param-value>
</init-param>
<init-param>
  <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
  <param-value>https://localhost:8443/cas/serviceValidate</param-value>
</init-param>
<init-param>
  <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
  <param-value>localhost:8080</param-value>
</init-param>
</filter><filter-mapping>
  <filter-name>CAS Filter</filter-name>
  <url-pattern>/servlets/servlet/HelloWorldExample</url-pattern>
</filter-mapping>目录：C:\Program Files (x86)\Apache Software Foundation\Tomcat 6.0\webapps\examples\WEB-INF\lib\放的JAR：     casclient.jar  | commons-logging-1.0.4.jar目录：C:\Program Files (x86)\Apache Software Foundation\Tomcat 6.0\webapps放了的war包： cas-server-webapp-3.4.2.1.warssocas