Javamail 和 gmail，得到“PKIX 路径构建失败”

Question

I'm trying to run a standalone Java class that will connect to Gmail as imap. Here is the code excerpt (username and pass masked)

    Properties props = System.getProperties();

    props.setProperty("mail.store.protocol", "imap"); 

    System.out.println("getting session");

    Session session = Session.getInstance(props);

    System.out.println("getting store");

    Store store = session.getStore("imaps");

    System.out.println("connecting");

    store.connect("imap.gmail.com", "xxxxx", "yyyyyy");

When trying to run, it displays the "connecting" message but throws this

javax.mail.MessagingException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target;
  nested exception is:
    javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I had done the following steps:

• a) (from a Linux instance): openssl s_client -connect imap.gmail.com:993
• b) from the above output copied the certificate into a pem file, then ran this on Windows

keytool -keystore cacerts -import -trustcacerts -alias gmailcert -file c:\gmailcert.pem -storepass changeit

The above step was in this folder C:\\Program Files\\Amazon Corretto\\jdk11.0.6_10\\lib\\security

In Eclipse, where I'm running the class, I set these jvm args

-Djavax.net.ssl.trustStore="c:/Program Files/Amazon Corretto/jdk11.0.6_10/lib/security/cacerts"
-Djavax.net.ssl.trustStorePassword="changeit"

I also tried

-Djavax.net.ssl.trustStore="c:\Program Files\Amazon Corretto\jdk11.0.6_10\lib/security\cacerts"
-Djavax.net.ssl.trustStorePassword="changeit"

and

-Djavax.net.ssl.trustStore="c:\\Program Files\\Amazon Corretto\\jdk11.0.6_10\\lib\\security\\cacerts"
-Djavax.net.ssl.trustStorePassword="changeit"

I also referred to this site , to make sure I'm importing the gmail cert correctly. I then ran an SSLPoke utility and get the same error, so it's something with the way I'm getting and importing the cert.

What am I missing?

Answer 1

Most likely you have an anti-virus program that's intercepting the connection. It would be better if you could configure it to allow a direct connection from your program. Lacking that, see the JavaMail FAQ for help with the certificate.