Java PKIX path building failed as non Admin

[BetziTheRealOne]

I updated the connection to my local repository from HTTP to HTTPS and I added the Certificate to cacerts. Since then I hava an issue, that i can't run mvn clean install as a normal User. But when i run VS Code as an Administrator i don't get that error. I want to build my Project as an normal User too. I guess its someting wrong with some rights, but i dont know what excactly. I installed both, Java and Maven, under C:/Programm Files

I gave my non Admin account full access to the Java and Maven folder.

The difference to similar tickets ist, that the build only runs as an Admin, but not as a normal User.

 

[KonradN]

Can you provide more details:

• what is the exact error you get (Full log of maven run!)
• Where excatly did you add the cert?

To use Java / Maven, write access to the java or maven installation directory is not required at all so there is no need to give these permissions inside c:\Program Files\.
Maven uses the .m2 Folder inside the user home.

 

[BetziTheRealOne]

StackTrace:
Could not transfer artifact org.springframework.boot:spring-boot-starter:jar:2.6.6 from/to nexus (https://srbvwrepo02:8081/repository/maven-public/): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.springframework.boot:spring-boot-starter:jar:2.6.6 from/to nexus (https://srbvwrepo02:8081/repository/maven-public/): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at io.takari.aether.connector.AetherRepositoryConnector$2.wrap(AetherRepositoryConnector.java:889)
at io.takari.aether.connector.AetherRepositoryConnector$2.wrap(AetherRepositoryConnector.java:1)
at io.takari.aether.connector.AetherRepositoryConnector$GetTask.flush(AetherRepositoryConnector.java:659)
at io.takari.aether.connector.AetherRepositoryConnector.get(AetherRepositoryConnector.java:337)
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:536)
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:448)
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:260)
at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies(DefaultRepositorySystem.java:352)
at org.apache.maven.project.DefaultProjectDependenciesResolver.resolve(DefaultProjectDependenciesResolver.java:182)
at org.apache.maven.project.DefaultProjectBuilder.resolveDependencies(DefaultProjectBuilder.java:224)
at org.apache.maven.project.DefaultProjectBuilder.build(DefaultProjectBuilder.java:202)
at org.apache.maven.project.DefaultProjectBuilder.build(DefaultProjectBuilder.java:123)
at org.eclipse.m2e.core.internal.IMavenToolbox.readMavenProject(IMavenToolbox.java:88)
at org.eclipse.m2e.core.internal.project.registry.DefaultMavenDependencyResolver.lambda$0(DefaultMavenDependencyResolver.java:70)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.executeBare(MavenExecutionContext.java:394)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:275)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:214)
at org.eclipse.m2e.core.internal.project.registry.DefaultMavenDependencyResolver.resolveProjectDependencies(DefaultMavenDependencyResolver.java:66)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryManager.refreshPhase2(ProjectRegistryManager.java:576)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryManager.lambda$5(ProjectRegistryManager.java:484)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.executeBare(MavenExecutionContext.java:394)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:275)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryManager.refresh(ProjectRegistryManager.java:482)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryManager.refresh(ProjectRegistryManager.java:367)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryRefreshJob.lambda$4(ProjectRegistryRefreshJob.java:154)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.executeBare(MavenExecutionContext.java:394)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:275)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:214)
at org.eclipse.m2e.core.internal.embedder.MavenImpl.execute(MavenImpl.java:1097)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryRefreshJob.lambda$0(ProjectRegistryRefreshJob.java:153)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.executeBare(MavenExecutionContext.java:394)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:275)
at org.eclipse.m2e.core.internal.embedder.MavenExecutionContext.execute(MavenExecutionContext.java:214)
at org.eclipse.m2e.core.internal.project.registry.ProjectRegistryRefreshJob.run(ProjectRegistryRefreshJob.java:106)
at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:336)
at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:300)
at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:185)
at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:224)
at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:107)
at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.java:87)
at okhttp3.internal.connection.Transmitter.newExchange(Transmitter.java:169)
at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:41)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142)
at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117)
at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:221)
at okhttp3.RealCall.execute(RealCall.java:81)
at io.takari.aether.okhttp.OkHttpAetherClient.execute(OkHttpAetherClient.java:215)
at io.takari.aether.okhttp.OkHttpAetherClient.get(OkHttpAetherClient.java:161)
at io.takari.aether.connector.AetherRepositoryConnector$GetTask.getResponse(AetherRepositoryConnector.java:655)
at io.takari.aether.connector.AetherRepositoryConnector$GetTask.resumableGet(AetherRepositoryConnector.java:600)
at io.takari.aether.connector.AetherRepositoryConnector$GetTask.run(AetherRepositoryConnector.java:481)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at java.base/sun.security.validator.Validator.validate(Unknown Source)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
... 40 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.base/java.security.cert.CertPathBuilder.build(Unknown Source)
... 45 more


I added the crt-File from the Server to JAVA_HOME/lib/security/cacerts via keytool

Strangely enough, the clean install has worked now, but i still have the Error in my pom.xml, mentioned above

 

[LimDul]

Eclipse Problem - Eclipse uses it own Key Store.

I just googled: https://support.checkmarx.com/CheckmarxCustomerServiceCommunity/s/article/Eclipse-Java-Configuration

Try something like this. Or google for eclipse keystore.

 

[BetziTheRealOne]

Eclipse Problem - Eclipse uses it own Key Store.

I just googled: https://support.checkmarx.com/CheckmarxCustomerServiceCommunity/s/article/Eclipse-Java-Configuration

Try something like this. Or google for eclipse keystore.

Thx, but i use VS Code.

 

[KonradN]

Please add the -X to the mvn call and provide the whole output. Not just the stacktrace.

Then we can see all details of the maven run. Maybe VS Code gives some parameters to maven or has some maven configuration that it is using. With the full debug output of maven, we will be able to see everything and nothing will be hidden.

If I have to guess: Maybe while adding the cert you modified the rights of the cacerts file? Or he tried to read the certs from somewhere else?

 

[LimDul]

I only saw the m2eclipse Plugin - so I guessed Eclipse.

Try to find, which JDK VSCode uses and how it starts the internal maven build. I guess it's accessing a different cacerts file.

 

[BetziTheRealOne]

VS Code ist using the correct JDK. the m2eclipse plugin came from my colleagues working on this project too.

Please add the -X to the mvn call and provide the whole output. Not just the stacktrace.

Then we can see all details of the maven run. Maybe VS Code gives some parameters to maven or has some maven configuration that it is using. With the full debug output of maven, we will be able to see everything and nothing will be hidden.

If I have to guess: Maybe while adding the cert you modified the rights of the cacerts file? Or he tried to read the certs from somewhere else?

The build succeeded, but I still have errors in my poms.
Nevertheless the full output of the run in the pined file.

 

[KonradN]

Ok, so the Problem regarding the cert is gone?

Was bei dem log aufgefallen ist, sind vor allem zwei Warnungen:
[WARNING] The POM for de.mycompany.plenigolenigo-domain:jar:0.0.1-SNAPSHOT is missing, no dependency information available
[WARNING] The POM for de.mycompany.invoiceInterface:sugarcrm-utils:jar:1.0.0 is missing, no dependency information available

Da scheinen eigene Libraries ins Repository gepackt worden zu sein ohne dass dabei eine .pom dabei ist.

Man kann Libraries per Maven zu einem repository hinzu fügen. Das wäre dann ein Aufruf wie:
mvn org.apache.maven.plugins:maven-install-plugin:2.5.2:install-file -Dfile=c:\somewhere\mylibrary.jar -DgroupId=my.group -DartifactId=myartefact -Dversion=0.0.1 -Dpackaging=jar -DlocalRepositoryPath=C:\my\repository
Pfade, Dateinamen und groupId/artefactId/version sind natürlich anzupassen.

Ansonsten reicht natürlich eine pom, die dabei liegt. Das, was das Maven plugin erzeugen würde, wäre z.B.:

<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>my.group</groupId>
  <artifactId>myartefact</artifactId>
  <version>0.0.1</version>
  <description>POM was created from install:install-file</description>
</project>

Aber das ist halt ein anderes Thema.

 

[BetziTheRealOne]

Der Build läuft zwar durch aber in meiner Pom habe ich trotzdem noch die Fehler, z.B.:
Failed to read artifact descriptor for de.mgoit.plenigolenigo-domain:jar:0.0.1

org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for de.mgoit.plenigolenigo-domain:jar:0.0.1
at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:242)
at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:172)
at org.eclipse.aether.internal.impl.collect.bf.BfDependencyCollector.resolveCachedArtifactDescriptor(BfDependencyCollector.java:464)
at org.eclipse.aether.internal.impl.collect.bf.BfDependencyCollector.resolveDescriptorForVersion(BfDependencyCollector.java:450)
at org.eclipse.aether.internal.impl.collect.bf.BfDependencyCollector.lambda$resolveArtifactDescriptorAsync$1(BfDependencyCollector.java:417)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$Head.forEach(Unknown Source)
at org.eclipse.aether.internal.impl.collect.bf.BfDependencyCollector.lambda$resolveArtifactDescriptorAsync$4(BfDependencyCollector.java:416)
at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: The following artifacts could not be resolved: de.mgoit.plenigolenigo-domainom:0.0.1 (absent): Could not transfer artifact de.mgoit.plenigolenigo-domainom:0.0.1 from/to nexus (https://srbvwrepo02:8081/repository/maven-public/): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:472)
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:260)
at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:242)
at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:231)
... 11 more

Komischerweise funktioniert bei meinen Kollegen aber alles.
Ich habe meinen PC neu aufgesetzt und alles (Java, Maven, VS Code) neu installiert, aber leider ohne Verbesserung.
Ich habe außerdem versucht das Projekt in eclipse zu öffnen, aber da bekomme ich schon PKIX Fehler wenn ich den Marketplace öffnen will.

 

[KonradN]

Wo siehst Du diese Fehler? Sind das Fehler in der IDE?

Das deutet dann ja darauf hin, dass die IDE die Zertifikate an anderer Stelle suchen. Der Link von @LimDul in #4 zeigt, wie man das setzen kann (-Djavax.net.ssl.trustStore und -Djavax.net.ssl.trustStorePassword beim entsprechenden java Aufruf sind eine Möglichkeit, wenn man nicht an vielen Stellen die Zertifikate einfügen möchte).

So wie der Link von @LimDul das für Eclipse aufzeigt, findest Du ähnliche Informationen zu VS Code (bzw. dem Java Language Plugin von VS Code) unter https://github.com/redhat-developer/vscode-java/issues/2259

 

[BetziTheRealOne]

Ich sehe die Fehler wenn ich in der POM über die markierten Stellen hover:



Ich habe die vmargs in der eclipse.ini angegeben und auch in VS Code eingestellt, leider ohne Erfolg.
Es ist ja nicht so, dass ich gar nicht mit dem Server sprechen kann. Die ganzen Artifacts lädt es ja herunter, aber ich bekomme eben diese ganzen Fehler.

 

[Oneixee5]

Da in der Fehlermeldung eine URL enthalten ist: Sind die Proxyeinstellungen der IDE richtig - kommst du ins Internet damit?

 

[KonradN]

Da in der Fehlermeldung eine URL enthalten ist: Sind die Proxyeinstellungen der IDE richtig - kommst du ins Internet damit?

Der Server wird erreicht, da er ja zum SSL Handshake kommt und dann darüber stolpert, dass das Zertifikat keinen vollständigen Trust Path hat.

Das ist zumindest meine Interpretation der Fehlermeldung von PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

 

[mihe7]

Hm... wenn ich https://srbvwrepo02 lese, dann frage ich mich, was in dem Zertifikat steht...

 

[KonradN]

Hm... wenn ich https://srbvwrepo02 lese, dann frage ich mich, was in dem Zertifikat steht...

Das wird wohl das Repo einer Firma sein mit eigene PKI Infrastruktur. Ist doch heutzutage üblich. Wenn Java unter Windows auf den Cert-Store von Windows zugreifen würde, dann würde man hier viele Probleme gar nicht haben....

Aber das wird der TE wohl besser sagen können. Die Erfahrung von mir mit mehreren Umgebungen muss hier ja nicht passen.

@BetziTheRealOne Evtl. macht es Sinn, einmal durchzugehen, an welchen Stellen Du was eingetragen hast. Und der Pfad, den Du setzt, ist von dem cacerts der Java Installation, die Du auch im Pfad hast?

Dann könnte man schauen, ob man da noch irgendwas sieht, was man anpassen / probieren könnte.