Gradle构建遇SSL错误：证书链问题及解决咨询

问题描述 #

在Windows 11系统执行./gradlew buildjob1时遭遇SSL握手错误，核心提示为PKIX路径构建失败、DigiCert Global Root G2证书链验证错误。相同证书配置的另一台Windows 11机器可正常运行该命令，推测问题出在本地JRE环境或Gradle安装配置。

执行命令及错误日志 #

$ ./gradlew buildjob1
Downloading https://services.gradle.org/distributions/gradle-7.1.1-bin.zip

Exception in thread "main" javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
        java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
        java.security.cert.CertPathValidatorException: Certificate chaining error
        at com.ibm.jsse2.j.a(j.java:31)
        at com.ibm.jsse2.as.a(as.java:262)
        at com.ibm.jsse2.C.a(C.java:515)
        at com.ibm.jsse2.C.a(C.java:11)
        at com.ibm.jsse2.D.a(D.java:720)
        at com.ibm.jsse2.D.a(D.java:635)
        at com.ibm.jsse2.C.r(C.java:44)
        at com.ibm.jsse2.C.a(C.java:184)
        at com.ibm.jsse2.as.a(as.java:481)
        at com.ibm.jsse2.as.i(as.java:130)
        at com.ibm.jsse2.as.a(as.java:483)
        at com.ibm.jsse2.as.startHandshake(as.java:160)
        at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:12)
        at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:15)
        at sun.net.www.protocol.http.HttpURLConnection.followRedirect0(HttpURLConnection.java:2678)
        at sun.net.www.protocol.http.HttpURLConnection.followRedirect(HttpURLConnection.java:2600)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1785)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1456)
        at com.ibm.net.ssl.www2.protocol.https.b.getInputStream(b.java:42)
        at org.gradle.wrapper.Download.downloadInternal(Download.java:100)
        at org.gradle.wrapper.Download.download(Download.java:80)
        at org.gradle.wrapper.Install$1.call(Install.java:68)
        at org.gradle.wrapper.Install$1.call(Install.java:48)
        at org.gradle.wrapper.ExclusiveFileAccessManager.access(ExclusiveFileAccessManager.java:69)
        at org.gradle.wrapper.Install.createDist(Install.java:48)
        at org.gradle.wrapper.WrapperExecutor.execute(WrapperExecutor.java:107)
        at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:63)
Caused by: com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
        java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
        java.security.cert.CertPathValidatorException: Certificate chaining error
        at com.ibm.jsse2.util.f.a(f.java:21)
        at com.ibm.jsse2.util.f.b(f.java:51)
        at com.ibm.jsse2.util.e.a(e.java:19)
        at com.ibm.jsse2.aA.a(aA.java:204)
        at com.ibm.jsse2.aA.a(aA.java:160)
        at com.ibm.jsse2.aA.checkServerTrusted(aA.java:207)
        at com.ibm.jsse2.D.a(D.java:67)
        ... 22 more
Caused by: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
        java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
        java.security.cert.CertPathValidatorException: Certificate chaining error
        at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:422)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
        at com.ibm.jsse2.util.f.a(f.java:153)
        ... 28 more
Caused by: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
        java.security.cert.CertPathValidatorException: Certificate chaining error
        at com.ibm.security.cert.BasicChecker.<init>(BasicChecker.java:111)
        at com.ibm.security.cert.PKIXCertPathValidatorImpl.engineValidate(PKIXCertPathValidatorImpl.java:199)
        at com.ibm.security.cert.PKIXCertPathBuilderImpl.myValidator(PKIXCertPathBuilderImpl.java:749)
        at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:661)
        at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:607)
        at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:368)
        ... 30 more
Caused by: java.security.cert.CertPathValidatorException: Certificate chaining error
        at com.ibm.security.cert.CertPathUtil.findIssuer(CertPathUtil.java:316)
        at com.ibm.security.cert.BasicChecker.<init>(BasicChecker.java:108)
        ... 35 more

本地Java环境信息 #

$ $JAVA_HOME/bin/java -version
java version "1.8.0"
Java(TM) SE Runtime Environment (build pwa6480sr3ifix-20160713_01(SR3+IX90174+IV85763))
IBM J9 VM (build 2.8, JRE 1.8.0 Windows 10 amd64-64 Compressed References 20160713_311397 (JIT enabled, AOT enabled)
J9VM - R28_Java8_SR3_20160713_0915_B311397
JIT  - tr.r14.java.green_20160329_114288
GC   - R28_Java8_SR3_20160713_0915_B311397_CMPRSS
J9CL - 20160713_311397)
JCL - 20160421_01 based on Oracle jdk8u91-b14

修复方法 #

1. 补充IBM JRE信任证书库中的DigiCert根证书 #

• 定位IBM JRE的证书库路径：$JAVA_HOME/jre/lib/security/cacerts
• 获取DigiCert Global Root G2证书：可以从正常运行的机器导出，或下载官方发布的该根证书
• 使用IBM JRE自带的keytool导入证书：

  keytool -importcert -alias digicertglobalrootg2 -file "C:\path\to\DigiCertGlobalRootG2.crt" -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit
  

  注：IBM JRE的cacerts默认密码为changeit，若已修改需替换为对应密码

2. 切换Gradle使用的JRE版本 #

• 安装与正常机器同版本的Oracle JRE/OpenJDK
• 临时指定JRE：执行命令前设置环境变量

  set JAVA_HOME=C:\Program Files\Java\jdk1.8.0_xxx
  ./gradlew buildjob1
  

• 永久配置：在项目根目录的gradle.properties中添加

  org.gradle.java.home=C:\Program Files\Java\jdk1.8.0_xxx
  

3. 清理并替换Gradle Wrapper文件 #

• 删除用户目录下的.gradle缓存文件夹（默认路径：C:\Users\<你的用户名>\.gradle）
• 删除项目根目录下的gradle/wrapper文件夹、gradlew和gradlew.bat文件
• 从正常机器复制对应的gradle/wrapper文件夹及脚本文件到本地项目，重新执行命令

临时Workaround（仅用于测试，生产环境禁用） #

1. 跳过SSL证书验证 #

• 修改项目gradle/wrapper/gradle-wrapper.properties添加系统属性：

  systemProp.javax.net.ssl.trustStore=./dummy.truststore
  systemProp.javax.net.ssl.trustStorePassword=changeit
  systemProp.javax.net.ssl.trustStoreType=JKS
  

• 或直接在命令行添加参数：

  ./gradlew buildjob1 -Djavax.net.ssl.trustStore=./dummy.truststore -Djavax.net.ssl.trustStorePassword=changeit -Djavax.net.ssl.trustStoreType=JKS
  

  注：dummy.truststore可通过keytool -genkey -alias dummy -keystore dummy.truststore生成空的JKS文件

2. 手动下载Gradle分发包 #

• 下载gradle-7.1.1-bin.zip，放到用户目录.gradle/wrapper/dists/gradle-7.1.1-bin/<随机哈希值>文件夹下，重新执行命令

内容的提问来源于stack exchange，提问作者Lucky