执行mvnw verify时遇SSLHandshakeException问题求助

尝试构建pact-workshop-Maven-Springboot-JUnit5的step1分支项目，运行mvnw verify命令时出现SSL握手失败错误：

C:\Users\MyUser\git\pact-workshop-Maven-Springboot-JUnit5\consumer>mvnw verify
Found "C:\Users\MyUser\git\pact-workshop-Maven-Springboot-JUnit5\consumer\.mvn\wrapper\maven-wrapper.jar"
JRE being used (logged by my modification in mvnw.cmd): "C:\Program Files (x86)\Java\jre7\bin\java.exe"
Takari Maven Wrapper 0.5.6
Downloading Maven binary from https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip
Downloading https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip

Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
    at org.apache.maven.wrapper.DefaultDownloader.downloadInternal(DefaultDownloader.java:90)
    at org.apache.maven.wrapper.DefaultDownloader.download(DefaultDownloader.java:76)
    at org.apache.maven.wrapper.Installer.createDist(Installer.java:72)
    at org.apache.maven.wrapper.WrapperExecutor.execute(WrapperExecutor.java:121)
    at org.apache.maven.wrapper.MavenWrapperMain.main(MavenWrapperMain.java:61)

已将Maven仓库的证书添加至C:\Program Files (x86)\Java\jre7\lib\security\cacerts，证书条目如下：

C:\WINDOWS\system32>"C:\Program Files (x86)\Java\jre7\bin\keytool.exe" -list -keystore "C:\Program Files (x86)\Java\jre7\lib\security\cacerts"
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 79 entries

apachemaven, 14.Eyl.2022, trustedCertEntry,
Certificate fingerprint (SHA1): 5E:9A:A9:4B:5A:8A:1C:31:DB:1F:B5:E6:CF:E4:4D:B1:4C:AE:2F:5F

1. JRE7不支持现代TLS协议版本 #

Maven中央仓库已停止对TLS 1.0、TLS 1.1的支持，而JRE7默认仅启用这些旧版本协议，导致握手失败。

解决方法：

• 临时方案：修改项目根目录下的mvnw.cmd，在启动Java的命令中添加强制启用TLS 1.2的参数。找到类似"%JAVA_EXE%" %JVM_CONFIG_MAVEN_PROPS% %MAVEN_OPTS% %MAVEN_DEBUG_OPTS% -classpath %WRAPPER_JAR% "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" %WRAPPER_LAUNCHER% %MAVEN_CMD_LINE_ARGS%的行，在%JVM_CONFIG_MAVEN_PROPS%后添加-Dhttps.protocols=TLSv1.2，修改后如下：

  "%JAVA_EXE%" %JVM_CONFIG_MAVEN_PROPS% -Dhttps.protocols=TLSv1.2 %MAVEN_OPTS% %MAVEN_DEBUG_OPTS% -classpath %WRAPPER_JAR% "-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" %WRAPPER_LAUNCHER% %MAVEN_CMD_LINE_ARGS%
  

• 永久方案：升级到JRE8及以上版本。JRE8默认支持TLS 1.2，且大多数现代Java项目已不再兼容JRE7，升级后能从根本上解决这类SSL协议兼容性问题。

2. 证书导入的有效性问题 #

即使已导入证书，仍可能存在以下问题：

• 导入的是中间证书而非根证书：访问Maven中央仓库时，服务器返回的证书链需要根证书被信任才能完成验证。建议通过浏览器打开Maven中央仓库地址，导出网站的根CA证书，再重新导入到cacerts中。
• 证书导入命令有误：确认导入时使用了正确的命令，示例如下（替换path/to/certificate.crt为实际证书路径）：

  "C:\Program Files (x86)\Java\jre7\bin\keytool.exe" -importcert -file path/to/certificate.crt -alias apachemaven -keystore "C:\Program Files (x86)\Java\jre7\lib\security\cacerts"
  

  输入密码时使用cacerts默认密码changeit（若未修改过）。

3. Maven Wrapper下载路径问题 #

可以绕过自动下载，手动配置Maven：

• 手动下载Maven 3.6.3压缩包，解压到本地目录。
• 修改项目.mvn/wrapper/maven-wrapper.properties文件，添加maven.home=D:/path/to/apache-maven-3.6.3（替换为实际解压路径），让Wrapper直接使用本地已有的Maven。

内容的提问来源于stack exchange，提问作者Cagin Uludamar