[英]JDK8 -> JDK10: PKIX path building failed: SunCertPathBuilderException: unable to find valid certification path to requested target
Launchdarkly
, which makes use of okhttp
Launchdarkly
的应用程序的SpringBoot应用程序,该应用程序使用okhttp
okhttp
okhttp
进行的调用失败 EDIT : This could happen with any app that has a certificate chain similar to the one used by our app. 编辑 :任何具有类似于我们应用程序使用的证书链的应用程序都可能发生这种情况。
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The error occurs in thie thread... 错误发生在线程中...
config-server_1 | 2018-11-10T21:25:19,147 67327 | DEBUG | okhttp-eventsource-[] ["okhttp-eventsource-stream-[]-0" {}] Connection problem.
config-server_1 | javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
config-server_1 | at sun.security.ssl.Alerts.getSSLException(Alerts.java:198) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1974) ~[?:?]
config-server_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:345) ~[?:?]
config-server_1 | at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:339) ~[?:?]
config-server_1 | at sun.security.ssl.ClientHandshaker.checkServerCerts(ClientHandshaker.java:1968) ~[?:?]
config-server_1 | at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1777) ~[?:?]
config-server_1 | at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:264) ~[?:?]
config-server_1 | at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1098) ~[?:?]
config-server_1 | at sun.security.ssl.Handshaker.processRecord(Handshaker.java:1026) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.processInputRecord(SSLSocketImpl.java:1137) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1074) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1402) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1429) ~[?:?]
config-server_1 | at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413) ~[?:?]
config-server_1 | at com.launchdarkly.shaded.okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:281) ~[launchdarkly-client-2.3.2.jar!/:2.3.2]
config-server_1 | at com.launchdarkly.shaded.okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:251) ~[launchdarkly-client-2.3.2.jar!/:2.3.2]
config-server_1 | at com.launchdarkly.shaded.okhttp3.internal.connection.RealConnection.connect(RealConnection.java:151) ~[launchdarkly-client-2.3.2.jar!/:2.3.2]
config-server_1 | at com.launchdarkly.shaded.okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:195) ~[launchdarkly-client-2.3.2.jar!/:2.3.2]
config-server_1 | at com.launchdarkly.shaded.okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:121) ~[launchdarkly-client-2.3.2.jar!/:2.3.2]
jlink
and selecting modules to build a small JRE jlink
和选择模块来构建一个小的JRE
JAVA_HOME
set... Not sure if we need anything else JAVA_HOME
...不知道我们是否还需要其他任何东西 Installed using the method above 使用上面的方法安装
root@e0776fd790e7:/runtime# ls -la /etc/ssl/certs/java/cacerts
-rw-r--r-- 1 root root 177280 Oct 29 16:29 /etc/ssl/certs/java/cacerts
root@e0776fd790e7:/runtime# java -version
openjdk version "10" 2018-03-20
OpenJDK Runtime Environment 18.3 (build 10+46)
OpenJDK 64-Bit Server VM 18.3 (build 10+46, mixed mode)
The java 10 keystore can see it Java 10密钥库可以看到它
root@17000659d1ec:/runtime# keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 80 entries
This is as described at https://dzone.com/articles/openjdk-10-now-includes-root-ca-certificates 如https://dzone.com/articles/openjdk-10-now-includes-root-ca-certificates所述
Tried to symlink or copy cacerts from JRE dir to
/etc/ssl/certs/java/cacerts
WORKS!试图符号链接或将cacerts从JRE目录复制到
/etc/ssl/certs/java/cacerts
! ALONG WITH COPYING FROM JDK 8从JDK 8复制
-Djavax.net.ssl.trustStore=/opt/jdk-minimal/jre/lib/security/cacerts
-Djavax.net.ssl.trustStore=/opt/jdk-minimal/jre/lib/security/cacerts
EDIT: See my answer 编辑:看到我的答案
certs
certs
root@c339504909345:/opt/jdk-minimal/jre/lib/security # keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 80 entries
root@c39596768075:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts # keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 151 entries
I haven't checked which certificate chain is not being trusted, but the server's URL certs are valid... The cacerts
from JDK 10 has a chain that's broken as of Today. 我尚未检查哪个证书链不受信任,但是服务器的URL证书有效...从JDK 10开始,
cacerts
的链从今天开始就已断开。 I can assert that because the download from https://download.java.net/java/GA/jdk10/10/binaries/openjdk-10_linux-x64_bin.tar.gz is being installed in a brand new Docker Image. 我可以断言,因为从https://download.java.net/java/GA/jdk10/10/binaries/openjdk-10_linux-x64_bin.tar.gz进行的下载已安装在全新的Docker映像中。
jlink
as /opt/jdk/bin/jlink \\ --module-path /opt/jdk/jmods...
jlink
作为/opt/jdk/bin/jlink \\ --module-path /opt/jdk/jmods...
建立一个最小的JRE /opt/jdk/bin/jlink \\ --module-path /opt/jdk/jmods...
So, here's the different paths and the sequence of the commands... 所以,这是命令的不同路径和顺序...
# Java 8
COPY --from=marcellodesales-springboot-builder-jdk8 /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts /etc/ssl/certs/java/cacerts
# Java 10
RUN rm -f /opt/jdk-minimal/jre/lib/security/cacerts
RUN ln -s /etc/ssl/certs/java/cacerts /opt/jdk-minimal/jre/lib/security/cacerts
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.