Confluence Server 6.13 or later throws an 'unable to find valid certification path' error when running with AdoptOpenJDK
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Problem
The following error appears when running Confluence Server or Data Center 6.13 or later with AdoptOpenJDK. Error can occur when Confluence attempts to connect to another web service, for example the Atlassian Marketplace, or when configuring an external user directory that is also hosted on AWS (on a different node).
1
2
...
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetThis issue is commonly seen when Confluence is hosted on AWS, but could occur wherever your Confluence is hosted.
Cause
AdoptOpenJDK 1.8.0_181 is missing a number of CA root certificates, including the "Starfield Services Root Certificate Authority" root certificate, which is issued by Amazon.
Workaround
As a workaround you can install the missing root certificates from the Amazon Trust Repository.
First, check whether a Starfield Services Root Certificate Authority certificate is present:
1
echo 'changeit'|keytool -list -v -keystore $(find ${JAVA_HOME} -name cacerts)|grep 'Owner'|grep 'Star'If the certificate is not present, you can install it using the following command:
1
wget https://www.amazontrust.com/repository/SFSRootCAG2.pem && keytool -trustcacerts -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -alias Root -import -file SFSRootCAG2.pem && rm SFSRootCAG2.pemResolution
We expect these certificates to be available again in a later AdoptOpenJDK version. See https://github.com/AdoptOpenJDK/openjdk-build/issues/676 for progress on this issue.
Was this helpful?