【GraalVM】gu install xxx I/O error occurred: PKIX path building failed: SunCertPathBuilderException

gu -v --debug install js

安装GraalVM插件时出现证书异常

Downloading: Component catalog from www.graalvm.org
Processing Component: Graal.js
Downloading: Component js: Graal.js from github.com
I/O error occurred: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

D:\ProgramFiles\Tools\fastgithub_win-x64\cacert>gu -v --debug install js
Downloading: Component catalog (source: https://www.graalvm.org/component-catalog/v2/graal-updater-component-catalog-java11.properties)
Receiving 674 kB: Done.
Processing Component: Graal.js
Preparing to install Graal.js, contains org.graalvm.js, version 22.3.2 (org.graalvm.js)
Checking requirements of component Graal.js (js), version 22.3.2
        Requires GraalVM Version = 22.3.2, GraalVM provides: 22.3.2
        Requires Java Version = 11, GraalVM provides: 11
        Requires Architecture = amd64, GraalVM provides: amd64
        Requires Operating System = windows, GraalVM provides: windows
Downloading: Component js: Graal.js (source: https://github.com/oracle/graaljs/releases/download/vm-22.3.2/js-installable-svm-java11-windows-amd64-22.3.2.jar)
I/O error occurred: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base@11.0.19/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base@11.0.19/sun.security.ssl.TransportContext.fatal(TransportContext.java:360)
        at java.base@11.0.19/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)
        at java.base@11.0.19/sun.security.ssl.TransportContext.fatal(TransportContext.java:298)
        at java.base@11.0.19/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
        at java.base@11.0.19/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
        at java.base@11.0.19/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
        at java.base@11.0.19/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base@11.0.19/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
        at java.base@11.0.19/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
        at java.base@11.0.19/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
        at java.base@11.0.19/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base@11.0.19/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1507)
        at java.base@11.0.19/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1417)
        at java.base@11.0.19/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
        at java.base@11.0.19/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
        at java.base@11.0.19/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:572)
        at java.base@11.0.19/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:201)
        at java.base@11.0.19/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:168)
        at org.graalvm.component.installer.remote.ProxyConnectionFactory$Connector.runWithContext(ProxyConnectionFactory.java:369)
        at org.graalvm.component.installer.remote.ProxyConnectionFactory$Connector.run(ProxyConnectionFactory.java:351)
        at java.base@11.0.19/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base@11.0.19/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base@11.0.19/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base@11.0.19/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base@11.0.19/java.lang.Thread.run(Thread.java:829)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:775)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.windows.WindowsPlatformThreads.osThreadStartRoutine(WindowsPlatformThreads.java:178)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base@11.0.19/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
        at java.base@11.0.19/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
        at java.base@11.0.19/sun.security.validator.Validator.validate(Validator.java:264)
        at java.base@11.0.19/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
        at java.base@11.0.19/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
        at java.base@11.0.19/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
        at java.base@11.0.19/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
        ... 23 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base@11.0.19/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
        at java.base@11.0.19/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:127)
        at java.base@11.0.19/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
        at java.base@11.0.19/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
        ... 29 more

我使用了FastGithub，然而FastGithub使用的是自签证书。

由于是自签证书。Java 不使用操作系统的本机信任存储，需要手动将证书导入到Java安装的密钥库中。使用以下命令将证书导入到Java的密钥库中：

keytool -import -alias fastgithub -keystore %JAVA_HOME%/lib/security/cacerts -file .\cacert\fastgithub.cer

在执行上述命令时，您需要将 fastgithub 和 .\cacert\fastgithub.cer 替换为实际的别名和证书文件名。对于默认的Java安装路径，您无需修改 %JAVA_HOME% 即可运行该命令。执行该命令后，系统会提示您输入 Java 密钥库的密码（默认为 “changeit”）以及确认导入证书的信息。

在使用Java keytool命令向密钥库中添加证书时，-alias是必需的参数，用于指定要添加的证书的别名。密钥库中的每个证书都必须具有唯一的别名。

注意：如果需要在多台计算机上执行此过程，请确保在所有计算机上使用相同的别名、证书和密码。