Mac M1环境下Eclipse Kepler无法访问Marketplace求助

问题现象 #

在Mac M1设备上运行Eclipse Kepler时，无法连接Eclipse Marketplace，弹出报错：

Cannot install remote marketplace locations: Connection failed.This is most often caused by a problem with your internet connection. Please check your internet connection and retry

补充报错提示：
Unable to read repository at http://marketplace.eclipse.org/content.xml.

已尝试的无效方案 #

• Eclipse内置浏览器可正常打开Google.com
• 将网络连接方式从直连改为手动/原生模式
• 为Eclipse禁用防火墙以允许外部连接
• 在eclipse.ini文件的-vmargs后添加-Djava.net.preferIPv4Stack=true配置
• 使用sudo命令以管理员身份启动Eclipse

关键报错日志 #

eclipse.buildId=4.3.0.M20130911-1000
java.version=1.7.0_71
java.vendor=Oracle Corporation
BootLoader constants: OS=macosx, ARCH=x86_64, WS=cocoa, NL=en_CA
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:421)
at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:150)
at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:575)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
at org.eclipse.ecf.provider.filetransfer.httpclient4.HttpClientFileSystemBrowser.runRequest(HttpClientFileSystemBrowser.java:263)
at org.eclipse.ecf.provider.filetransfer.browse.AbstractFileSystemBrowser$DirectoryJob.run(AbstractFileSystemBrowser.java:69)
at org.eclipse.core.internal.jobs.Worker.run(Worker.java:53)

针对性解决方案 #

日志核心错误为javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated，本质是Java 7的根证书库过时，无法验证Eclipse Marketplace的SSL证书，同时Kepler默认的网络配置不支持现代TLS协议，按以下步骤解决：

1. 导入Marketplace的SSL证书到Java 7信任库 #

打开终端执行以下命令：

• 导出Marketplace的SSL证书：

  openssl s_client -connect marketplace.eclipse.org:443 < /dev/null | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > marketplace.crt
  

• 将证书导入Java 7的cacerts库（注意替换为你实际的Java 7路径）：

  sudo keytool -importcert -file marketplace.crt -keystore /Library/Java/JavaVirtualMachines/jdk1.7.0_71.jdk/Contents/Home/jre/lib/security/cacerts -alias marketplace.eclipse.org
  

  输入默认密码changeit完成导入，提示是否信任时输入yes。

2. 强制Eclipse使用TLS 1.2协议 #

编辑Eclipse安装目录下的eclipse.ini文件，在-vmargs行之后添加：

-Dhttps.protocols=TLSv1.2

3. 替换Marketplace仓库地址为HTTPS #

打开Eclipse，依次进入：
Window > Preferences > Install/Update > Available Software Sites
找到名为Eclipse Marketplace的条目，将其地址从http://marketplace.eclipse.org/content.xml修改为https://marketplace.eclipse.org/content.xml，保存设置后重启Eclipse。

内容的提问来源于stack exchange，提问作者max092012