“对等方未通过身份验证"与使用Letsencrypt SSL保护的网站交谈时(在JDK7上) [英] "peer not authenticated" when talking to websites secured with Letsencrypt SSL (on JDK7)

问题描述

我正在尝试执行一个简单的grails config命令，该命令下面将从Internet检索一些pom，jar和zip文件，以配置我的项目.

但是对于其中一个软件包，这是我遇到的错误(我必须添加--stacktrace开关以显示此错误):

| Error Resolve error obtaining dependencies: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE (NOTE: Stack trace has been filtered. Use --verbose to see entire trace.)
org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:335)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:217)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.process(DefaultDependencyCollector.java:466)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.collectDependencies(DefaultDependencyCollector.java:261)
        at org.eclipse.aether.internal.impl.DefaultRepositorySystem.collectDependencies(DefaultRepositorySystem.java:317)
        at grails.util.BuildSettings.doResolve(BuildSettings.groovy:513)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy:661)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy)
        at grails.util.BuildSettings.getDefaultProvidedDependencies(BuildSettings.groovy:655)
        at grails.util.BuildSettings.getProvidedDependencies(BuildSettings.groovy:637)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:460)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:262)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:239)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:320)
        ... 9 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:43)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:342)
        at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(RunnableErrorForwarder.java:67)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(BasicRepositoryConnector.java:649)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:247)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:536)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:437)
        ... 12 more
Caused by: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
        at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:126)
        at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:493)
        at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:232)
        at org.apache.http.impl.conn.ManagedClientConnectionImpl.layerProtocol(ManagedClientConnectionImpl.java:401)
        at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:840)
        at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:647)
        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479)
        at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
        at org.apache.http.impl.client.DecompressingHttpClient.execute(DecompressingHttpClient.java:137)
        at org.eclipse.aether.transport.http.HttpTransporter.execute(HttpTransporter.java:294)
        at org.eclipse.aether.transport.http.HttpTransporter.implGet(HttpTransporter.java:250)
        at org.eclipse.aether.spi.connector.transport.AbstractTransporter.get(AbstractTransporter.java:59)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:418)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:337)
        ... 17 more

" https://repo.transmartfoundation.org/content/repositories/public/"网站配置为使用 Letsencrypt SSL证书.

我正在使用JDK 7u80-windows-x64.

解决方案

如对此回复，Java 7> = 7u111和Java 8> = 8u101都包含此类根证书，并且不再需要以下过程.

因此，如给定脚本所述，应该下载

以及Linux上的命令:

keytool -delete -alias letsencryptauthorityx3 -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit
keytool -trustcacerts -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit -noprompt -importcert -alias letsencryptauthorityx3 -file lets-encrypt-x3-cross-signed.der

(也从对类似问题但又不完全相同的另一个答复中获得灵感)

I'm trying to do a simple grails config command which underneath will retrieve some pom, jar and zip files from the Internet, configuring my project.

But for one of the package, here is the error I have (I had to add the --stacktrace switch to display this error):

| Error Resolve error obtaining dependencies: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE (NOTE: Stack trace has been filtered. Use --verbose to see entire trace.)
org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for org.grails.plugins:smart-r:zip:16.2-STABLE
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:335)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:217)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.process(DefaultDependencyCollector.java:466)
        at org.eclipse.aether.internal.impl.DefaultDependencyCollector.collectDependencies(DefaultDependencyCollector.java:261)
        at org.eclipse.aether.internal.impl.DefaultRepositorySystem.collectDependencies(DefaultRepositorySystem.java:317)
        at grails.util.BuildSettings.doResolve(BuildSettings.groovy:513)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy:661)
        at grails.util.BuildSettings$_getDefaultProvidedDependencies_closure16.doCall(BuildSettings.groovy)
        at grails.util.BuildSettings.getDefaultProvidedDependencies(BuildSettings.groovy:655)
        at grails.util.BuildSettings.getProvidedDependencies(BuildSettings.groovy:637)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:460)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:262)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:239)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:320)
        ... 9 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.grails.plugins:smart-r:pom:16.2-STABLE from/to repo_transmartfoundation_org_content_repositories_public_ (https://repo.transmartfoundation.org/content/repositories/public/): peer not authenticated
        at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:43)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:342)
        at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(RunnableErrorForwarder.java:67)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(BasicRepositoryConnector.java:649)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:247)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:536)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:437)
        ... 12 more
Caused by: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
        at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:126)
        at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:493)
        at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:232)
        at org.apache.http.impl.conn.ManagedClientConnectionImpl.layerProtocol(ManagedClientConnectionImpl.java:401)
        at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:840)
        at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:647)
        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479)
        at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
        at org.apache.http.impl.client.DecompressingHttpClient.execute(DecompressingHttpClient.java:137)
        at org.eclipse.aether.transport.http.HttpTransporter.execute(HttpTransporter.java:294)
        at org.eclipse.aether.transport.http.HttpTransporter.implGet(HttpTransporter.java:250)
        at org.eclipse.aether.spi.connector.transport.AbstractTransporter.get(AbstractTransporter.java:59)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:418)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:337)
        ... 17 more

The "https://repo.transmartfoundation.org/content/repositories/public/" website is configured to use a Letsencrypt SSL certificate.

I'm using JDK 7u80-windows-x64.

解决方案

As said in Letsencrypt forum, JDK 7 does not trust Let's Encrypt root certificate.

Nevertheless, according to this reply Java 7 >= 7u111 and Java 8 >= 8u101 include such root certificate and the following process is no more required.

So as written in the given script, one should download https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.der and import it in the local <JAVA_HOME>/jre/lib/security/cacerts.

Before this process, don't forget to backup cacerts file in case.

Here is the command on windows:

keytool -delete -alias letsencryptauthorityx3 -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit
keytool -trustcacerts -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit -noprompt -importcert -alias letsencryptauthorityx3 -file lets-encrypt-x3-cross-signed.der

And the command on Linux:

keytool -delete -alias letsencryptauthorityx3 -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit
keytool -trustcacerts -keystore "$JAVA_HOME/jre/lib/security/cacerts" -storepass changeit -noprompt -importcert -alias letsencryptauthorityx3 -file lets-encrypt-x3-cross-signed.der

(Also inspired from another reply on a similar question but which is not exactly the same)

这篇关于“对等方未通过身份验证"与使用Letsencrypt SSL保护的网站交谈时(在JDK7上)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！