从 jcenter 下载时出现工件证书错误

Question

我们正在使用 artifactory oss，几天后我们在从 jcenter 存储库下载 jar 时遇到了一些问题。它不适用于所有下载，也不清楚为什么。下载时出现以下错误：

Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.6/commons-lang-2.6.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

这里奇怪的是，我们试图从 http 源下载，而不是像有效认证所期望的那样从 https 下载。

在查看日志时，我们可以看到有 2 种不同的方法，其中一种是“httpRepo”，它运行良好，一个总是失败的是“RemoteRepoBase”，但不清楚为什么有时会使用该方法，并且其他时间。

这是工作和非工作下载日志的截图：

2018-05-22 16:03:25,928 [https-jsse-nio-8060-exec-6] [INFO ] (o.a.r.HttpRepo      :414) - jcenter downloading http://jcenter.bintray.com/commons-lang/commons-lang/2.1/commons-lang-2.1.jar 202.85 KB
2018-05-22 16:03:25,992 [https-jsse-nio-8060-exec-6] [INFO ] (o.a.r.HttpRepo      :427) - jcenter downloaded  http://jcenter.bintray.com/commons-lang/commons-lang/2.1/commons-lang-2.1.jar 202.85 KB at 3,247.54 KB/sec
2018-05-22 16:03:52,322 [https-jsse-nio-8060-exec-12] [INFO ] (o.a.r.HttpRepo      :414) - jcenter downloading http://jcenter.bintray.com/commons-lang/commons-lang/2.5/commons-lang-2.5.jar 272.65 KB
2018-05-22 16:03:52,662 [https-jsse-nio-8060-exec-12] [INFO ] (o.a.r.HttpRepo      :427) - jcenter downloaded  http://jcenter.bintray.com/commons-lang/commons-lang/2.5/commons-lang-2.5.jar 272.65 KB at 807.36 KB/sec
2018-05-22 16:03:57,121 [art-exec-6] [INFO ] (o.a.s.a.ArchiveIndexerImpl:145) - Indexing archive: jcenter-cache:commons-lang/commons-lang/2.1/commons-lang-2.1.jar
2018-05-22 16:03:57,328 [art-exec-6] [INFO ] (o.a.s.a.ArchiveIndexerImpl:145) - Indexing archive: jcenter-cache:commons-lang/commons-lang/2.5/commons-lang-2.5.jar
2018-05-22 16:07:58,243 [https-jsse-nio-8060-exec-7] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.6/commons-lang-2.6.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.6/commons-lang-2.6.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:10,319 [https-jsse-nio-8060-exec-7] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.6/commons-lang-2.6.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.6/commons-lang-2.6.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:13,255 [https-jsse-nio-8060-exec-12] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.6/commons-lang-2.6.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.6/commons-lang-2.6.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:13,874 [https-jsse-nio-8060-exec-7] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.6/commons-lang-2.6.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.6/commons-lang-2.6.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:22,943 [https-jsse-nio-8060-exec-4] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.3/commons-lang-2.3.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.3/commons-lang-2.3.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:35,290 [https-jsse-nio-8060-exec-5] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.3/commons-lang-2.3.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.3/commons-lang-2.3.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).
2018-05-22 16:08:52,519 [https-jsse-nio-8060-exec-12] [WARN ] (o.a.r.RemoteRepoBase:433) - jcenter: Error in getting information for 'commons-lang/commons-lang/2.2/commons-lang-2.2.jar' (Failed retrieving resource from http://jcenter.bintray.com/commons-lang/commons-lang/2.2/commons-lang-2.2.jar: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target).

Answer 1

证书路径错误很可能是通过 SSL 重定向到 Bintray 的 CDN 的结果，无论远程 repo URL 是 http 而不是 https。如果您尝试使用 cURL 拉取此文件，您会看到它确实重定向到 https://akamai.bintray.com。

服务器证书似乎没问题，也就是说，我个人能够通过我的 Artifactory 实例和使用 cURL 提取文件，而不会看到任何 SSL 验证错误。

话虽如此，我们通常会看到此类错误的发生主要有以下几个原因：

1. 有人（有时可能是您的 IT 部门）在托管 Artifactory 的服务器上修改了 JDK/JRE 安装的“cacerts”文件。该文件包含受信任的 CA 列表，就像浏览器一样，它会告诉您的 Java 安装在启动 SSL 连接时哪些证书是受信任的。当您尝试通过 SSL 连接到 akamai.bintray.com 或 jcenter.bintray.com 时，您可以使用 cURL 或“openssl”检查证书。这些证书由标准可信 CA 颁发。
2. 这种情况不太常见 - 但有时使用不是主流供应商之一的 JDK 供应商（即 Oracle、openJDK 等）需要拥有过时/非标准的“cacerts”文件。当此类安装附带不包含标准受信任 CA 根证书的“cacerts”文件时，您很可能会看到此错误。
3. 甚至更牵强，但我已经看到这种情况发生 - 您的连接是通过公司代理启动的，该代理促进诸如“ssl-bumping”之类的事情，或者充当 MITM，试图通过提供模仿的假证书来欺骗您的 SSL 流量目标服务器证书，导致客户端上的 SSL 验证错误。

希望对你有帮助