What to do if you get a security certificate error:

# Fetch CA bundle from Cloudflare repo
$ curl -o cf-ca-bundle.crt -L https://raw.githubusercontent.com/cloudflare/cfssl_trust/master/ca-bundle.crt

# Split bundle in individual certs
$ csplit -f cf-ca-cert -z ca-bundle.crt '/-----BEGIN CERTIFICATE-----/' '{*}'

# Import the CA certs into an existing truststore file (eg: myTrustStoreFile). Adjust -storepass apropiately 
$ for ca in ls cf-ca-cert*; do keytool -import -storepass changeit -keystore myTrustStoreFile -alias $ca -file $ca -noprompt; done

// App.java

import java.net.*;
import java.net.http.*;
import java.util.*;
import java.nio.charset.StandardCharsets;
import java.util.stream.Collectors;

public class App {
  public static void main(String[] args) throws Exception {
var httpClient = HttpClient.newBuilder().build();

HashMap<String, String> params = new HashMap<>();

params.put("page[number]", "1");
params.put("page[size]", "20");
params.put("filter[channel_type_id][eq]", "webhook");

var query = params.keySet().stream()
   .map(key -> key + "=" + URLEncoder.encode(params.get(key), StandardCharsets.UTF_8))
   .collect(Collectors.joining("&"));

var host = "https://api.telnyx.com";
var pathname = "/v2/notification_channels";
var request = HttpRequest.newBuilder()
   .GET()
   .uri(URI.create(host + pathname + '?' + query))
   .header("Authorization", "Bearer ".concat(System.getenv("TELNYX_TOKEN")))
   .build();

var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());
  }

# Compile App.java
$ javac App.java

# Run App without creds
$ java App
{
  "errors": [
{
   "code": "10009",
   "title": "Authentication failed",
   "detail": "Could not understand the provided credentials.",
   "meta": {
     "url": "https://developers.telnyx.com/docs/overview/errors/10009"
   }
}
  ]
}

# Run App with creds
$ export TELNYX_TOKEN="<YOUR_TELNYX_API_TOKEN>"
$ java App
{"data": [], "meta": {"total_pages": 0, "total_results": 0, "page_number": 1, "page_size": 20}}

# Fetch the default cacerts truststore
## When using JDK
$ cp ${JAVA_HOME}/lib/security/cacerts ./
## When using JRE
$ cp ${JAVA_HOME}/jre/lib/security/cacerts ./

# Confirm test App works as expected
$ java -Djavax.net.ssl.trustStore=cacerts -Djavax.net.ssl.trustStorePassword=changeit App
{"data": [], "meta": {"total_pages": 0, "total_results": 0, "page_number": 1, "page_size": 20}}

# Delete relevant certificate from the truststore
$ keytool -delete -alias debian:baltimore_cybertrust_root.pem -storepass changeit -keystore cacerts

# Run App again and it will fail
$ java -Djavax.net.ssl.trustStore=cacerts -Djavax.net.ssl.trustStorePassword=changeit App
Exception in thread "main" javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at java.net.http/jdk.internal.net.http.HttpClientImpl.send(HttpClientImpl.java:560)
     at java.net.http/jdk.internal.net.http.HttpClientFacade.send(HttpClientFacade.java:119)
     at App.main(App.java:28)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
...
     at java.base/java.lang.Thread.run(Thread.java:831)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
...
    atjava.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
... 21 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
...
     at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
...26more