Windows系统下使用databricks-connect连接Databricks集群失败求助

问题现象 #

执行databricks-connect test时抛出证书错误：

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at sun.security.validator.Validator.validate(Validator.java:271)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:312)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:275)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:140)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:630)
    ... 27 more                                                                          
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 33 more

已安装Java 1.8，执行以下命令导入证书但问题未解决：

keytool -importcert -trustcacerts -alias repo -file C:\Users\ravi\Downloads\adbcert.crt -keystore cacerts "C:\Java\jdk1.8.0_333\jre\lib\security\cacerts" -storepass changeit

解决步骤 #

• 修正证书导入命令
  原命令中-keystore参数同时写了cacerts和具体路径，导致keytool识别错误，正确命令如下：

  keytool -importcert -trustcacerts -alias repo -file C:\Users\ravi\Downloads\adbcert.crt -keystore "C:\Java\jdk1.8.0_333\jre\lib\security\cacerts" -storepass changeit
  

  重新执行该命令，确保证书导入成功。

• 验证证书是否导入成功
  执行以下命令检查keystore中是否存在目标证书：

  keytool -list -keystore "C:\Java\jdk1.8.0_333\jre\lib\security\cacerts" -storepass changeit | findstr "repo"
  

  若输出包含repo，说明证书已成功导入。

• 确认Databricks-Connect使用的Java环境
  检查当前终端的Java版本，确保与导入证书的JDK一致：

  java -version
  

  若版本不符，将目标JDK的bin路径添加到系统环境变量PATH最前端，或在执行测试前指定Java路径：

  set PATH=C:\Java\jdk1.8.0_333\bin;%PATH%
  databricks-connect test
  

• 检查证书完整性
  确认下载的adbcert.crt是完整的根证书链，而非仅服务器证书。若从浏览器导出，需选择导出完整证书链格式（如PKCS#7）后重新导入。

• 重启终端生效
  证书导入后重启当前终端，确保环境变量和keystore变更生效。

内容的提问来源于stack exchange，提问作者Ramineni Ravi Teja