eclipse - "PKIK path building failed"尝试使用 WAS 8 插件从 Eclipse 3.6 中的 github 克隆 repo

Question

我已经安装了 Eclipse Java EE Developers Helios SR2 IDE。从 Eclipse 市场安装的唯一附加插件是 WebSphere Application Server 8.0 Developer Tools (8.0.4) 和 JGit/EGit。

在我按照 IBM 站点上的步骤更新 eclipse.ini 文件以使用 WAS8 附带的 IBM 提供的 JRE 之前，我可以很好地附加到 github。

一旦我将 Eclipse 更改为使用 IBM JRE，我就无法连接到 github。例如，当我尝试克隆存储库时，我在此处遇到错误:

my/url/to.git: cannot open git-upload-pack
java.lang.ClassNotFoundException: Cannot find the specified class com.ibm.websphere.ssl.protocol.SSLSocketFactory

我更新了这里记录的配置文件: http://publib.boulder.ibm.com/infocenter/radhelp/v7r5/index.jsp?topic=%2Fcom.ibm.ws.ast.st.v6.ui.doc%2Ftopics%2Frssl_isUseIBMSSLSocketFactory.html

我改了之后还是不行。我收到此错误:

my/url/to.git: cannot open git-upload-pack
com.ibm.jsse2.util.g: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: 
    java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: 
    java.security.cert.CertPathValidatorException: Certificate chaining error

Answer 1

(首先，我不确定为什么要在IBM JRE上运行Eclipse。如果您需要将IBM JRE用于特定项目(甚至默认)作为运行环境，您可以将其添加并设置在工作区(或项目)属性。)

发生此错误是因为 IBM JRE 不信任此证书(CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US ) 开箱即用。

Oracle 和 IBM JRE 都带有一组默认的可信 CA 证书。

在 Oracle Java 中，它们位于“jssecacerts, if it exists. Otherwise, cacerts”中。文档还说:

IMPORTANT NOTE: The JDK ships with a limited number of trusted root certificates in the /lib/security/cacerts file. As documented in keytool, it is your responsibility to maintain (that is, add/remove) the certificates contained in this file if you use this file as a truststore.

Depending on the certificate configuration of the servers you contact, you may need to add additional root certificate(s). Obtain the needed specific root certificate(s) from the appropriate vendor.

对于 IBM JRE，这可能在不同的地方，但最终，这条建议也适用:最终由您来确保您拥有您想要信任的 CA 证书。例如，您可以从浏览器导出它们。