1

Our new firewall provides a transparent proxy which issues self-signed SSL certificates for secure (HTTPS) connections.

Android Studio asked me to accept two certificates, which I confirmed.

Existing projects build fine. Only if I change or add dependencies in the build.gradle file, this error message appears:

Gradle 'MyApp' project refresh failed
Error:Cause: unable to find valid certification path to requested target

Is there a way to tell the Gradle plugin to trust the firewall-generated SSL certificates?

mjn42
  • 830
  • 1
  • 8
  • 24

2 Answers2

2

Downgrading security should be always avoided ;)

A solution exists as per Jetbrains post:

Eh, this is a Jetbrains/IDEA issue. Despite being able to pick the gradle wrapper's Java installation, the grabbing of the wrapper is still done with the JRE which the IDE is currently using... Preventing the wrapper from even starting. It should prompt to trust the certificate like everywhere else in the IDE but it does not. In the interim I have posted instructions to fix this for those who need it. (This issue persists in 2017.2.1)

Based on the comments on that post I wrote this bash script:

#!/bin/bash

set -eu

CA_PEM_FILE="${1?Missing path to certificate file}"
ANDROID_STUDIO_PATH="${2:-/opt/android-studio/jre/jre/lib/security}"

if [ -f "${CA_PEM_FILE}" ]
    then
        printf "\n>>> ADDING A CERTIFICATE TO ANDROID STUDIO <<<\n"

        # https://intellij-support.jetbrains.com/hc/en-us/community/posts/115000094584-IDEA-Ultimate-2016-3-4-throwing-unable-to-find-valid-certification-path-to-requested-target-when-trying-to-refresh-gradle
        cd "${ANDROID_STUDIO_PATH}" && \
        printf "changeit\nyes\n" | keytool -keystore cacerts -importcert -alias ProxyCertificate -file "${CA_PEM_FILE}" && \

        printf "\n >>> CERTICATE ADDED SUCCESEFULY<<<\n"

    else
        printf "\n >>> FATAL ERROR: Certificate not found in path ${CA_PEM_FILE} <<<\n"
fi

Invoke like:

sudo ./add-certificate-to-android-studio.sh /etc/ssl/certs/ProxyCA.pem

If you have installed Android Studio in a location different from /opt/android-studio then you must invoke like:

sudo ./add-certificate-to-android-studio.sh /etc/ssl/certs/ProxyCA.pem /android/path
Exadra37
  • 11,244
  • 3
  • 43
  • 57
0

I found a working solution/workaround in this answer:

Force Gradle to use HTTP instead of HTTPS

I replaced jcenter() with maven { url "http://jcenter.bintray.com" } in two places.

This workaround requires that jcenter is accessible over HTTP which might get disabled in the future for security reasons.

Community
  • 1
  • 1
mjn42
  • 830
  • 1
  • 8
  • 24