K
Q

Openshift Deployment F8: Cannot access cluster for detecting mode: sun.security.validator.ValidatorException

5/18/2018

I am deploying sample springboot application using fabric8 maven deploy. The build fails with SSLHandshakeException.

F8: Cannot access cluster for detecting mode: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Failed to execute goal io.fabric8:fabric8-maven-plugin:3.1.80.redhat-000010:build (default) on project fuse-camel-sb-rest: Execution default of goal io.fabric8:fabric8-maven-plugin:3.1.80.redhat-000010:build failed: An error has occurred. sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal io.fabric8:fabric8-maven-plugin:3.1.80.redhat-000010:build (default) on project fuse-camel-sb-rest: Execution default of goal io.fabric8:fabric8-maven-plugin:3.1.80.redhat-000010:build failed: An error has occurred.

So, I downloaded the public certificate from the Openshift webconsole and added it to JVM using

C:\...\jdk.\bin>keytool -import -alias rootcert -file C:\sample\RootCert.cer -keystore cacerts

and got message that its successfully added to the keystore and the list command shows the certificates added.

    C:\...\jdk.\bin>keytool -list -keystore cacerts
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

rootcert, May 18, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): XX:XX:XX:..........

But the mvn:fabric8 deploy build still fails with the same exception.

Can someone shed some light on this issue? Am I missing anything?

-- jack
fabric8
java
kubernetes
openshift
ssl-certificate

Similar Questions

Error while copying local file to k8s container
Kubernetes Dashboard Static Password FIle uer cannot list <resources>
Why should I specify service before deployment in a single Kubernetes configuration file?
VolumeClaimTemplates with subPath
Maistra ServiceMeshControlPlane and Mesh in same namespace/project on OpenShift4
Failed to pull image &quot;velero/velero-plugin-for-gcp:v1.1.0&quot; while installing Velero in GKE Cluster
Hazelcast doesn&#39;t connect to pods when using Headless Service

4 Answers

4/4/2019

I solved on Windows adding the Openshift certificate with the following:

keytool -import -trustcacerts -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -storepass changeit -alias Root -import -file openshift.der

The openshift.der is in BASE64.

-- SHoko
Source: StackOverflow
2/25/2019

The following works on MacOS:

The certificate to install is the one found on the browser URL bar;
On Firefox (at least) click the padlock padlock icon to the left of the URL, then proceed down Connection > / More Information / View Certificate / Details, finally Export... allows you to save the certificate locally.

On the command-line, determine which JRE maven is using:

$ mvn --version
Apache Maven 3.5.4 (1edded0938998edf8bf061f1ceb3cfdeccf443fe; 2018-06-17T19:33:14+01:00)
Maven home: /Users/.../apache-maven-3.5.4
Java version: 1.8.0_171, vendor: Oracle Corporation, runtime: /Library/Java/JavaVirtualMachines/jdk1.8.0_171.jdk/Contents/Home/jre
Default locale: en_GB, platform encoding: UTF-8
OS name: "mac os x", version: "10.12.6", arch: "x86_64", family: "mac"

You will likely need to be 'root' to update the cacerts file.

$ sudo keytool -import -alias my-openshift-clustername -file /Users/.../downloads/my-cluster-cert.crt -keystore $JAVA_HOME/jre/lib/security/cacerts
Password: {your password for sudo}
Enter keystore password: {JRE cacerts password, default is changeit}
... keytool prints certificate details...
Trust this certificate? [no]:  yes
Certificate was added to keystore

Verify that the certificate was indeed added successfully:

$ keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts
Enter keystore password: changeit
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 106 entries

...other entries, in no particular order...
my-openshift-clustername, 25-Feb-2019, trustedCertEntry,
Certificate fingerprint (SHA1): F4:17:3B:D8:E1:4E:0F:AD:16:D3:FF:0F:22:73:40:AE:A2:67:B2:AB
...other entries...
-- Ed Randall
Source: StackOverflow
5/24/2018

Adding the certificates to the "cacerts" in $JAVAHOME/jre/lib/security solved the issue.

-- jack
Source: StackOverflow
2/1/2019

Jack's solution works fine on Windows. I exported certificate from webrowser, when I was on openshift webconsole. Then I added cert to cacerts in $JAVAHOME/jre/lib/security: keytool -import -alias my.alias -file C:\sample\RootCert.cer -keystore cacerts

-- MrBig
Source: StackOverflow