Error in download_and_extract: java.io.IOException: Error downloading [] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilder

I am getting this error.

(08:45:12) WARNING: Download from https://github.com/bazelbuild/rules_foreign_cc/archive/0.8.0.tar.gz failed: class javax.net.ssl.SSLHandshakeException PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
(08:45:12) ERROR: An error occurred during the fetch of repository 'rules_foreign_cc':
   Traceback (most recent call last):
    File "/home/apollo_project/apollo/.cache/bazel/b52035c489e6fe2bd45e6bc6d0d71be2/external/bazel_tools/tools/build_defs/repo/http.bzl", line 132, column 45, in _http_archive_impl
        download_info = ctx.download_and_extract(
Error in download_and_extract: java.io.IOException: Error downloading [https://apollo-system.bj.bcebos.com/archive/6.0/rules_foreign_cc-0.8.0.tar.gz, 
https://github.com/bazelbuild/rules_foreign_cc/archive/0.8.0.tar.gz] to /home/apollo_project/apollo/.cache/bazel/b52035c489e6fe2bd45e6bc6d0d71be2/external/rules_foreign_cc/
temp5947386906325017422/rules_foreign_cc-0.8.0.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This occurred when building to use open source called apollo.
It seems that the part that downloads the file using Bazel is in the build script, but that error occurred.
I also set as below.

keytool -importcert -alias startsl -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -file my.crt

The basic proxy setting of the docker container has been set.
The part where download is attempted in the build script I also confirmed that download is successful with wget.
(wget https://apollo-system.bj.bcebos.com/archive/6.0/rules_foreign_cc-0.8.0.tar.gz,
wget https://github.com/bazelbuild/rules_foreign_cc/archive/0.8.0.tar.gz)
What more settings do I need?

Solution

I solved the problem with the following settings.
I create [~/.bazelrc] and add the following contents

startup --host_jvm_args=-Djavax.net.ssl.trustStore=/usr/lib/jvm/openjdk-8u342-b07/jre/lib/security/cacerts \
        --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit

And I add the following contents to [~/.bashrc] as well.

export JAVA_HOME=/usr/lib/jvm/openjdk-8u342-b07

And it was solved after restarting my docker container.
Of course, I have already set the settings below.

keytool -importcert -alias startssl -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -file my.crt