Flutter在Android设备/模拟器运行时出现SSL证书错误如何解决？

报错信息 #

Launching lib/main.dart on ONEPLUS A6003 in debug mode...
Running Gradle task 'assembleDebug'...
Exception in thread "main" javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:349)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
    at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:287)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
    at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:171)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1408)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1314)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:411)
    at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:567)
    at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1592)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1520)
    at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:250)
    at org.gradle.wrapper.Download.downloadInternal(Download.java:58)
    at org.gradle.wrapper.Download.download(Download.java:44)
    at org.gradle.wrapper.Install$1.call(Install.java:61)
    at org.gradle.wrapper.Install$1.call(Install.java:48)
    at org.gradle.wrapper.ExclusiveFileAccessManager.access(ExclusiveFileAccessManager.java:65)
    at org.gradle.wrapper.Install.createDist(Install.java:48)
    at org.gradle.wrapper.WrapperExecutor.execute(WrapperExecutor.java:128)
    at org.gradle.wrapper.GradleWrapperMain.main(GradleWrapperMain.java:61)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at java.base/sun.security.validator.Validator.validate(Validator.java:264)
    at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
    ... 24 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 30 more
Exception: Gradle task assembleDebug failed with exit code 1

错误根因 #

该报错是构建过程中Gradle拉取资源时，Java运行环境无法通过SSL证书校验，无法建立安全连接导致的，和Flutter本身版本、项目结构无关，因此此前尝试的升级Flutter、重建安卓项目均无法解决问题。

解决方案 #

• 方案1：替换国内Gradle镜像源（优先尝试，绝大多数国内用户可通过该方案解决）
  找到项目android目录下的build.gradle、settings.gradle两个文件，将默认的google、mavenCentral仓库全部替换为阿里云镜像：

  maven { url 'https://maven.aliyun.com/repository/google' }
  maven { url 'https://maven.aliyun.com/repository/public' }
  maven { url 'https://maven.aliyun.com/repository/gradle-plugin' }
  

  同时修改android/gradle/wrapper/gradle-wrapper.properties文件中的Gradle下载地址为国内镜像源地址。

• 方案2：导入目标站点证书到JDK信任库
  如果你需要使用原生官方镜像源，可手动导出访问失败的站点的SSL证书，导入到构建所用的JDK的cacerts信任库中，操作命令如下：

  # 替换为实际的证书路径、JDK安装路径，默认信任库密码为changeit
  keytool -import -alias gradle_repo -file 你的证书存储路径.cer -keystore 你的JDK安装路径/jre/lib/security/cacerts
  

• 方案3：临时关闭Gradle SSL校验（仅用于临时调试，不推荐长期使用）
  在项目根目录的gradle.properties文件中添加如下配置，跳过SSL证书验证环节：

  systemProp.javax.net.ssl.trustStore=NONE
  systemProp.jsse.enableSNIExtension=false
  com.android.build.gradle.unsafe.ignore-ssl-errors=true
  

内容的提问来源于stack exchange，提问作者Amr