scala sbt 和公司代理 - SunCertPathBuilderException
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/41981320/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
scala sbt and corporate proxy - SunCertPathBuilderException
提问by Thiago Say?o
When I try to use SBT some files cannot be downloaded with the following error:
当我尝试使用 SBT 时，某些文件无法下载并出现以下错误：
Server access Error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target url=https://repo1.maven.org/maven2/org/scala-sbt/sbt/1.0.0-M4/sbt-1.0.0-M4.jar
服务器访问错误：sun.security.validator.ValidatorException：PKIX 路径构建失败：sun.security.provider.certpath.SunCertPathBuilderException：无法找到请求目标的有效认证路径 url= https://repo1.maven.org/maven2/ org/scala-sbt/sbt/1.0.0-M4/sbt-1.0.0-M4.jar
I have followed some advice on Stack Overflow and imported the corporate proxy SSL certificate with the java keytool as described in: SSL certificate problem in a web service proxy
我遵循了 Stack Overflow 上的一些建议，并使用 java keytool 导入了公司代理 SSL 证书，如下所述： Web 服务代理中的 SSL 证书问题
It does not seems to affect the SBT tool. Does it look in a different keystore? Any ideas?
它似乎不会影响 SBT 工具。它看起来在不同的密钥库中吗？有任何想法吗？
If I paste the URL on the browser the file downloads.
如果我将 URL 粘贴到浏览器上，文件就会下载。
I get this error when simply running the SBT tool I have installed. When I try to create a SBT project on IntelliJ Idea and update it, it gives me the same error with different URLs. Same thing when trying to use the lightbend activator.
简单地运行我安装的 SBT 工具时，我会收到此错误。当我尝试在 IntelliJ Idea 上创建一个 SBT 项目并更新它时，它给我不同的 URL 相同的错误。尝试使用光弯激活器时也是如此。
回答by ameet chaubal
So this happens when you are behind a proxy and we need the proxy server certificate to be added to the java truststore
因此，当您在代理后面并且我们需要将代理服务器证书添加到 java 信任库时，就会发生这种情况
cp $JAVA_HOME/jre/lib/security/cacerts <some accessible dir>/
# Get the certificate of the proxy server and store it in a file-proxy.pem
keytool -keystore cacerts -import -file proxy.pem -alias my_proxy
# Now we can invoke sbt with following config
sbt "-Djavax.net.ssl.trustStore=/path/to/included/proxycert/cacerts" compile
回答by Brian Smith
If I recall correctly, SBT indirectly uses an old version of apache commons httpclient (3.1) which doesn't respect the java system properties for specifying truststores by default.
如果我没记错的话，SBT 间接使用旧版本的 apache commons httpclient (3.1)，它不尊重默认情况下指定信任库的 java 系统属性。
I can think of three potential solutions:
我可以想到三种可能的解决方案：
Use a proxy repository like artifactoryso SBT can only has to connect to the proxy and the proxy can take care of https outwards via the corporate proxy.
Install the corporate issuing certificate into the default truststore for the JVM (usually
%JDK_HOME%/jre/lib/security/cacerts). You would have to do this each time you run a new JRE.Try using coursier. It's a plugin for SBT which provides a different way of fetching dependencies that does not go through apache httpclient. It uses an http library which I think should respect the java system properties for truststore. It's also much faster.
使用像artifactory这样的代理存储库，这样 SBT 只需连接到代理，代理就可以通过公司代理向外处理 https。
将公司颁发的证书安装到 JVM 的默认信任库中（通常为
%JDK_HOME%/jre/lib/security/cacerts）。每次运行新的 JRE 时都必须这样做。尝试使用cousier。它是 SBT 的一个插件，它提供了一种不同的方式来获取不通过 apache httpclient 的依赖项。它使用一个 http 库，我认为它应该尊重 truststore 的 java 系统属性。它也快得多。
回答by Thiago Say?o
This solved the problem:
这解决了这个问题：
Add -Djavax.net.ssl.trustStore="C:\Program Files\Java\jre1.8.0_121\lib\security\cacerts" to the sbt config file (sbtconfig).
将 -Djavax.net.ssl.trustStore="C:\Program Files\Java\jre1.8.0_121\lib\security\cacerts" 添加到 sbt 配置文件 (sbtconfig)。
If using IntelliJ Idea, click on "SBT Settings" -> JVM Options -> VM Parameters and add the same line.
如果使用 IntelliJ Idea，请单击“SBT 设置”-> JVM 选项-> VM 参数并添加相同的行。
The path is the path to the cacerts file that resides on the JDK path -> lib -> security.
该路径是驻留在 JDK 路径 -> lib -> security 上的 cacerts 文件的路径。
It is necessary to import the proxy certificate with the keystore tool, as described in: SSL certificate problem in a web service proxy
需要使用keystore工具导入代理证书，如：web service proxy中的SSL证书问题
回答by stefan.schwetschke
This error can also happen if you use an outdated Java version. I've got this error using Java version 1.8.0_45-b14. Updating to Java version 11.0.2+7 (2018-10-16) solved it for me.
如果您使用过时的 Java 版本，也会发生此错误。我在使用 Java 版本 1.8.0_45-b14 时遇到了这个错误。更新到 Java 版本 11.0.2+7 (2018-10-16) 为我解决了这个问题。
Just for reference, the full error message I got was:
仅供参考，我收到的完整错误消息是：
[error] typesafe-ivy-releases: unable to get resource for com.geirsson#sbt-scalafmt;1.6.0-RC4: res=https://repo.typesafe.com/typesafe/ivy-releases/com.geirsson/sbt-scalafmt/1.6.0-RC4/jars/sbt-scalafmt.jar: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
[错误] typesafe-ivy-releases：无法获得 com.geirsson#sbt-scalafmt 的资源；1.6.0-RC4：res= https://repo.typesafe.com/typesafe/ivy-releases/com.geirsson/ sbt-scalafmt/1.6.0-RC4/jars/sbt-scalafmt.jar：javax.net.ssl.SSLHandshakeException：sun.security.validator.ValidatorException：PKIX路径构建失败：sun.security.provider.certpath.SunCertPathBuilderException：无法找到请求目标的有效认证路径
Switching to the newer Java version solved it instantly.
切换到较新的 Java 版本立即解决了它。
回答by Vlad
On MacOS, I solved it by running the sbtcommand with sudo.
在 MacOS 上，我通过sbt使用sudo.
