Java默认证书异常求助：PKIX路径构建失败，重装JDK无效

每次运行纯Java程序（包括编程工具、运行环境、基于Java的编译程序，但不依赖Java的应用不受影响）都会报错。比如运行Gradle时会抛出：

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

其他Java程序也出现相同问题。已经卸载重装过所有JDK和JRE，修改了JAVA_HOME和Path环境变量，但错误依旧。没有连接自定义SSL服务器，只是访问Java默认服务器，无法理解cacerts文件里的默认证书为什么会失效。推测问题是某次Java更新后出现的，已经持续2个月左右。尝试过用keytool工具，但Java 17里找不到对应的.cer文件。

完整异常堆栈跟踪：

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
    at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
    at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:589)
    at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1665)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1589)
    at java.base/java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:529)
    at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:308)
    at net.minecraftforge.installer.DownloadUtils.getConnection(DownloadUtils.java:243)
    at net.minecraftforge.installer.DownloadUtils.downloadManifest(DownloadUtils.java:307)
    at net.minecraftforge.installer.json.Util.getVanillaVersion(Util.java:73)
    at net.minecraftforge.installer.actions.ServerInstall.run(ServerInstall.java:86)
    at net.minecraftforge.installer.InstallerPanel.run(InstallerPanel.java:423)
    at net.minecraftforge.installer.SimpleInstaller.launchGui(SimpleInstaller.java:175)
    at net.minecraftforge.installer.SimpleInstaller.main(SimpleInstaller.java:147)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at java.base/sun.security.validator.Validator.validate(Validator.java:264)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
    ... 24 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:127)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 29 more
Failed to download version manifest, can not find server jar URL.

可能的解决方法 #

• 检查代理/防火墙拦截：关闭系统代理、VPN或防火墙后重试，部分代理会替换SSL证书，导致Java无法识别。
• 修复cacerts文件：
  1. Java 17的cacerts文件路径为$JAVA_HOME/lib/security/cacerts（Windows下是%JAVA_HOME%\lib\security\cacerts），默认密码是changeit。
  2. 从同版本的干净JDK中复制cacerts文件替换当前文件；或手动导入根证书：
     • 用浏览器访问报错的目标服务器，导出网站根证书为.crt文件。
     • 执行keytool命令导入：

       keytool -import -alias 自定义别名 -file 证书文件路径 -keystore $JAVA_HOME/lib/security/cacerts
       

• 更新Java版本：升级到最新的Java 17小版本，或临时切换到Java 11等稳定版本测试。
• 检查系统证书存储：
  • Windows：更新系统根证书，确保系统证书存储完整有效。
  • Linux/macOS：更新系统的ca-certificates包。

内容的提问来源于stack exchange，提问作者DeadStar