HPUXJDKJRE80 JDK_8.0.23 fail connecting to maven.org with error javax.net.ssl.SSLHandshake

[szhong]

When using HP JDK_8.0.23 default truststore for downloading articfacts from https://repo1.maven.org, we get the error

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The testcase build.xml:

<project name="test-download" xmlns:ivy="antlib:org.apache.ivy.ant" default="resolve">

    <target name="download-ivy" unless="offline">

        <!-- download Ivy from web site so that it can be used even without any special installation -->
        <get src="https://repo1.maven.org/maven2/org/apache/ivy/ivy/2.5.0/ivy-2.5.0.jar" 
             dest="ivy-2.5.0.jar" usetimestamp="true" verbose="true"/>
    </target>
</project>

 The download succeeds when we use the default truststore from a OracleJDK 8 version.
ANT_OPTS=-Djavax.net.ssl.trustStore=<OracleJDK 8 install location>/jre/lib/security/cacerts

Why doesn't HP JDK_8.0.23 contain the default truststore from OracleJDK 8? 

[techin]

@szhong  Is your query on HP UX?

[szhong]

@techinThis query is on HP UX.

# uname -r
B.11.31

# swlist HPUX*OE*
# HPUX11i-DC-OE B.11.31.1705 HP-UX Data Center Operating Environment
HPUX11i-DC-OE.OE B.11.31.1705 HP-UX OE control script product

HP JDK Used: https://myenterpriselicense.hpe.com/cwp-ui/free-software/JDKJRE8023

[mbarnwal]

This may require further troubleshooting, you may contact HPE and open a case for this.

[szhong]

I am unable to open a case for this.  It is pretty obvious by looking at the number of certficates in the HP JDK trust store that it is the cause of the failure (HP JDK doesn't have the certficated required).

$ keytool -list -keystore <path_to_oracle_jdk>/jdk1.8.0_112/jre/lib/security/cacerts
...
Your keystore contains 104 entries
...

While on HP JDK

$ keytool -list -keystore <path_to_HP_JDK>/jdk_1.8.0.23/opt/java8/jre/lib/security/cacerts
...
Your keystore contains 59 entries
...

There are 45 less entries in HP JDK than the Oracle JDK distribution.

[Sunitha_Mod]

Hello @szhong,

Kindly click the below link to contact HPE Support: 

https://support.hpe.com/help/en/Content/supportAndOtherResources.html

https://www.hpe.com/psnow/doc/A00039121ENW

https://www.hpe.com/in/en/contact-hpe.html

Technical Support phone numbers

Contact Information is mentioned below for your reference:

Contact HPE Support: 1-800-633-3600

Contact HPE Sales: 000 800 040 1716

Thank you for your persistent co-operation.