spring-boot - 在 jenkin 中运行 OWASP 依赖检查器时遇到 SSLHandshakeException

Question

Error:
15:35:18 [ERROR] UpdateException: Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta
15:35:18 [ERROR] caused by DownloadFailedException: Download failed, unable to retrieve 'https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta'; Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta; unable to connect.
15:35:18 [ERROR] caused by DownloadFailedException: Error downloading file https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.meta; unable to connect.
15:35:18 [ERROR] caused by SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
15:35:18 [ERROR] caused by ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
15:35:18 [ERROR] caused by SunCertPathBuilderException: unable to find valid certification path to requested target
15:35:18 [ERROR] NoDataException: No documents exist

我们添加了依赖检查器插件 pom.xml

<plugin>  
         <groupId>org.owasp</groupId>  
         <artifactId>dependency-check-maven</artifactId>  
         <version>6.0.3</version>  
         <executions>  
           <execution>  
             <goals>  
               <goal>check</goal>  
             </goals>  
           </execution>  
         </executions>  
         <configuration>         
           <!-- Generate all report formats -->             
           <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>          
         </configuration>  
       </plugin>

Answer 1

此错误通常表示您的 JVM 无法创建到服务器 nvd.nist.gov 的安全 (https) 连接，因为它不信任服务器提供的证书。为了信任服务器，服务器或签名机构的公共(public)证书必须位于 JVM 使用的信任库中。默认情况下，信任库位于 %JAVA_HOME%\lib\security\cacerts，您可以使用以下 (windows) keytool -list -keystore "%JAVA_HOME%\lib\"列出其内容security\cacerts"-storepass changeit。您应该看到一个证书列表，如果 digicertglobalrootg2 未列出，您需要导入它以信任服务器，因为该证书由 CN=DigiCert Global Root G2, OU=www.digicert .com，O=DigiCert Inc，C=US。您使用的是什么版本的 Java？以上证书可能不包含在java trust stores中1.8 之前。