Search code examples
javagradlekeytoolpkixcacerts

What is PKIX-error and how to fix/workaround it for gradle project in a corporate environment?

There is a requirement in our corporate environment to import corporate certificate to installed JDK. Imported cert into almost all possible locations and installations... Set JAVA_HOME before commands that may use it and set JAVA_HOME in ~/.bashrc... Nevertheless, I'm getting same error everytime:

Starting a Gradle Daemon, 2 stopped Daemons could not be reused, use --status for details

FAILURE: Build failed with an exception.

* Where:
Initialization script '/Users/user/.gradle/init.gradle' line: 2

* What went wrong:
A problem occurred evaluating root project 'some-project'.
> Could not get resource 'https://nexus.our.corp.domain/repository/raw-hosted/gradle/vx.x.x/service.gradle'.
   > Could not GET 'https://nexus.our.corp.domain/repository/raw-hosted/gradle/vx.x.x/service.gradle'.
      > The server may not support the client's requested TLS protocol versions: (TLSv1.2, TLSv1.3). You may need to configure the client to allow other protocols to be used. See: https://docs.gradle.org/7.5.1/userguide/build_environment.html#gradle_system_properties
         > PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

init.gradle contents:

gradle.allprojects {
    ext.use_script = { name -> apply from: "$scripts_repo/${name}.gradle" }
}

PKIX error happens even if I completely remove all contents from ~/.gradle, gradlew, make gradle --stop and try to initalize/generate gradlew from scratch:

gradle wrapper --gradle-version x.x.x
Starting a Gradle Daemon, 2 stopped Daemons could not be reused, use --status for details

FAILURE: Build failed with an exception.

* Where:
Initialization script '/Users/user/.gradle/init.gradle' line: 2

* What went wrong:
A problem occurred evaluating root project 'some-project'.
> Could not get resource 'https://nexus.our.corp.domain/repository/raw-hosted/gradle/vx.x.x/service.gradle'.
   > Could not GET 'https://nexus.our.corp.domain/repository/raw-hosted/gradle/vx.x.x/service.gradle'.
      > The server may not support the client's requested TLS protocol versions: (TLSv1.2, TLSv1.3). You may need to configure the client to allow other protocols to be used. See: https://docs.gradle.org/7.5.1/userguide/build_environment.html#gradle_system_properties
         > PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

gradle --version shows correct version of JVM:

gradle --version

------------------------------------------------------------
Gradle 7.5.1
------------------------------------------------------------

Build time:   2022-08-05 21:17:56 UTC
Revision:     d1daa0cbf1a0103000b71484e1dbfe096e095918

Kotlin:       1.6.21
Groovy:       3.0.10
Ant:          Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM:          11.0.17 (Amazon.com Inc. 11.0.17+8-LTS)
OS:           Mac OS X 10.16 x86_64

And it appears that gradle version is not quite important as one of our colleagues stumbled upon the same problem with gradle version: 6.4.1

So what is this PKIX-error (keeping in mind that certs were successfuly imported) and what is the possible solution/fix/workaround for it?

  • tried for several JDK versions in different locations (all below candidates were imported successfuly without errors, but nevetheless above PKIX-error appeared anyway):
  1. JAVA_HOME=/usr/local/Cellar/openjdk@8/1.8.0+352 keytool -importcert -file /path/to/certs/corp-cert -alias Root -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
  2. JAVA_HOME=/usr/local/Cellar/openjdk@11/11.0.16.1_1 keytool -importcert -file /path/to/certs/corp-cert -alias Root -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
  3. export JAVA_HOME=/usr/libexec/java_home -v 11.0.13; echo "JAVA_HOME-contents: ${JAVA_HOME}"; keytool -importcert -file /path/to/certs/corp-cert -alias Root -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
  4. JAVA_HOME=$HOME/.sdkman/candidates/java/11.0.17-amzn keytool -importcert -file /path/to/certs/corp-cert -alias Root -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
  • tried removing completely all gradle dir (rm -rfv ~/.gradle) and gradlew scripts from project, because suggested that may be gradle versions somehow interfere/messed up
  • tried removing all sdkman leftovers and installing all required items from scratch (sdk install java 11.0.17-amzn), because suggested that may be gradle versions somehow interfere/messed up
Solution

  • Turns out it was wrong certificate all the time...