Skip to main content

Code With Me On-Premises. Unable to download JetBrains Client — PKIX path building failed

Semyon Martynchik
Updated

Problem

  • Impossible to download a JetBrains Client.
  • Errors like this in the lobby server log:
ERROR unhandled exception: com.x.L.d.o.Yn: Unable to download https://download.jetbrains.com/idea/code-with-me/JetBrainsClient-241.15989.150.jbr.win.zip.sha256: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Cause

The issue could happen due to the corporate firewall or proxy settings. Most likely, there is a certificate substitution or man-in-the-middle setup. Therefore, all external downloads via the web proxy will present an unsigned SSL certificate. In this case, the lobby server rejecting the download.

Resolution

This issue could be fixed by installing the local certificates to the lobby server's Java keystore.

  1. Save a self-signed certificate to a file in one of the supported formats (the file is referred to as below). This can be done in a browser by inspecting certificate data and exporting it as a Base64 encoded X.509 certificate.
  2. Locate the JRE used by the lobby server process. Almost all JetBrains products use a bundled custom Java runtime provided by JetBrains. An example of how to locate it from a test environment:
root@a7085201edee:/home/lobby-server# ps aux
root 1 3.7 8.3 2643316 81372 ? Ssl 09:50 0:02 /home/lobby-server/jbr/bin/java -jar /home/lobby-server/lib/lobby-server-fatjar.jar
root@a7085201edee:/home/lobby-server# /home/lobby-server/jbr/bin/java -version
openjdk version "11.0.9.1" 2020-11-04
OpenJDK Runtime Environment JBR-11.0.9.1.11-1207.1-jcef (build 11.0.9.1+11-b1207.1)
OpenJDK 64-Bit Server VM JBR-11.0.9.1.11-1207.1-jcef (build 11.0.9.1+11-b1207.1, mixed mode)
  1. Import the server certificate into the default JRE installation keystore using JVM's keytool tool:
keytool -importcert -file <cert file> -keystore <path to JRE installation>/lib/security/cacerts

The default password for all java keystores is changeit.

Additional information

https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html https://support.cloudbees.com/hc/en-us/articles/217078498-PKIX-path-building-failed-error-message

Comments

0 comments

Please sign in to leave a comment.