"peer not authenticated" when talking to websites secured with Letsencrypt SSL (on JDK7)

Question

I'm trying to do a simple grails config command which underneath will retrieve some pom, jar and zip files from the Internet, configuring my project.

But for one of the package, here is the error I have (I had to add the --stacktrace switch to display this error):

| Error Resolve error obtaining dependencies: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE (NOTE: Stack trace has been filtered. Use --verbose to see entire trace.)
org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:335)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:217)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.process(DefaultDependencyCollector.java:466)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.collectDependencies(DefaultDependencyCollector.java:261)
        at org.eclipse.aether.internal.impl.DefaultRepositorySystem.collectDependencies(DefaultRepositorySystem.java:317)
        at grails.util.BuildSettings.doResolve(BuildSettings.groovy:513)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy:661)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy)
        at grails.util.BuildSettings.getDefaultProvidedDependencies(BuildSettings.groovy:655)
        at grails.util.BuildSettings.getProvidedDependencies(BuildSettings.groovy:637)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:460)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:262)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:239)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:320)
        ... 9 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:43)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:342)
        at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(RunnableErrorForwarder.java:67)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(BasicRepositoryConnector.java:649)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:247)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:536)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:437)
        ... 12 more
Caused by: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
        at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:126)
        at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:493)
        at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:232)
        at org.apache.http.impl.conn.ManagedClientConnectionImpl.layerProtocol(ManagedClientConnectionImpl.java:401)
        at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:840)
        at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:647)
        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479)
        at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
        at org.apache.http.impl.client.DecompressingHttpClient.execute(DecompressingHttpClient.java:137)
        at org.eclipse.aether.transport.http.HttpTransporter.execute(HttpTransporter.java:294)
        at org.eclipse.aether.transport.http.HttpTransporter.implGet(HttpTransporter.java:250)
        at org.eclipse.aether.spi.connector.transport.AbstractTransporter.get(AbstractTransporter.java:59)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:418)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:337)
        ... 17 more

The "https://repo.transmartfoundation.org/content/repositories/public/" website is configured to use a Letsencrypt SSL certificate.

I'm using JDK 7u80-windows-x64.

Anthony O. · Accepted Answer · 2017-08-24T14:01:32.163

As said in Letsencrypt forum, JDK 7 does not trust Let's Encrypt root certificate.

Nevertheless, according to this reply Java 7 >= 7u111 and Java 8 >= 8u101 include such root certificate and the following process is no more required.

So as written in the given script, one should download https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.der and import it in the local <JAVA_HOME>/jre/lib/security/cacerts.

Before this process, don't forget to backup cacerts file in case.

Here is the command on windows:

keytool -delete -alias letsencryptauthorityx3 -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit
keytool -trustcacerts -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit -noprompt -importcert -alias letsencryptauthorityx3 -file lets-encrypt-x3-cross-signed.der

And the command on Linux:

keytool -delete -alias letsencryptauthorityx3 -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit
keytool -trustcacerts -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit -noprompt -importcert -alias letsencryptauthorityx3 -file lets-encrypt-x3-cross-signed.der

(Also inspired from another reply on a similar question but which is not exactly the same)

"peer not authenticated" when talking to websites secured with Letsencrypt SSL (on JDK7)

1 Answers1