Mac系统安装Eclipse报SSL握手异常 是否与使用公司笔记本有关

该故障与你使用公司配发办公笔记本高度相关。

故障根因 #

报错核心为javax.net.ssl.SSLHandshakeException: PKIX path building failed，即HTTPS连接建立阶段SSL证书校验不通过，Eclipse内置的Java运行环境无法验证官方下载源的证书有效性，直接中断安装流程。
这类问题在企业管控设备上高发的核心原因：

• 公司办公设备默认会接入企业安全网关，所有对外HTTPS流量会经过企业SSL代理，网关会使用企业自有的根证书对所有站点证书做重签名
• Eclipse安装程序内置的Java环境默认信任库仅包含公共可信CA证书，未导入企业自签根证书，因此会判定连接不安全直接断开
• 个人设备在普通家庭网络环境下访问Eclipse官方源不会触发该类错误

可行修复方案 #

• 联系公司IT运维人员获取企业根证书文件，将证书导入Eclipse安装依赖的Java环境信任库，执行导入命令：
  keytool -import -alias company-ca-root -file [企业根证书本地路径] -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
• 临时切换至不受企业管控的网络（如个人手机热点），关闭系统代理后重新启动安装程序，待安装完成后再切回公司网络
• 直接下载对应版本的Eclipse离线完整安装包，本地执行安装无需联网拉取资源，可直接绕过证书校验环节

附核心报错日志 #

[2022-07-01 18:41:02] Repository https://download.eclipse.org/releases/2022-06/202206151000
[2022-07-01 18:41:02] Repository https://download.eclipse.org/oomph/updates/milestone/latest
[2022-07-01 18:41:03] ERROR: org.eclipse.equinox.p2.transport.ecf code=1002 Unable to read repository at https://download.eclipse.org/technology/epp/packages/2022-06/202206091200/content.xml.
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
    at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
    at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
    at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(Unknown Source)
    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source)
    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source)
    at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
    at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
    at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:273)
    at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:241)
    at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:148)

内容的提问来源于stack exchange，提问作者Sunil Chaudhari