2

I am trying to install native-image for my GraalVM in Windows environment. In cmd, I used the below command,

gu install native-image

But it shows this error,

Downloading: Release index file from oca.opensource.oracle.com

Error: Error reading component list: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

James Z
  • 12,209
  • 10
  • 24
  • 44
Alien Programmer
  • 21
  • 2
  • 2
    It might be that your organization has got a man-in-the-middle SSL firewall product. This would require that browsers have root certificates for this firewall, but Java (and GraalVM) has its own set of certificates which may not have been updated. Try running the gu command outside your corporate firewall if possible/allowed. – prunge Feb 13 '22 at 23:48
  • try pointing JAVA_HOME to GraalVM – Munish Chouhan Jun 06 '22 at 13:42

1 Answers1

0

As the error states your environment from which gu is estabilishing a secure connection to the remote repository cannot verify the certification path of the repository. In other words your JVM does not trust oca.opensource.oracle.com.

The $JAVA_HOME/lib/security/cacerts file contains the collection of trusted CA used by JVM when running gu. Apparently this file in your JDK is missing the certificate chain of your repository.

Adding new trusted certificate

  1. Download oca.opensource.oracle.com repository's root certificate.
  2. Open $JAVA_HOME/lib/security/cacerts file in elevated mode with e.g. KeyStore Explorer or modify it with keytool. Default password is changeit.
  3. Add new trusted CA from 1.
  4. Save and close.

Useful sources

In our organization the issue was in the man-in-the-middle SSL firewall product as mentioned by prunge.

Rok Prodan
  • 749
  • 8
  • 22