PKIX error when I attempt to install repository-S3 plugin

Elastic Stack Elasticsearch
1

Hi,

When I attempt to install the repository-s3 plugin I receive an error "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" (full stack trace below). I am running version 5.5.2 of Elasticsearch, and JVM version 1.8.0.

Can somebody advise me either of how I could fix this error, or how I can begin to debug the problem?

I appreciate that I can download the plugin as a zip file, and install it manually but I would like to understand this problem better before taking that approach.

Stack trace:

Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    	at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
    	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
    	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
    	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
    	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
    	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
    	at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
    	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
    	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
    	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
    	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
    	at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    	at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
    	at org.elasticsearch.plugins.InstallPluginCommand.urlExists(InstallPluginCommand.java:300)
    	at org.elasticsearch.plugins.InstallPluginCommand.getElasticUrl(InstallPluginCommand.java:267)
    	at org.elasticsearch.plugins.InstallPluginCommand.download(InstallPluginCommand.java:223)
    	at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:215)
    	at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:201)
    	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67)
    	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122)
    	at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:69)
    	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122)
    	at org.elasticsearch.cli.Command.main(Command.java:88)
    	at org.elasticsearch.plugins.PluginCli.main(PluginCli.java:47)
    Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    	at sun.security.validator.Validator.validate(Validator.java:260)
    	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
    	... 21 more
    Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
    	... 27 more

Elasticsearch version:

{
  "name" : "lB76ZQG",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "yZxKsRCYRB2MIwe1zlesWA",
  "version" : {
    "number" : "5.5.2",
    "build_hash" : "b2f0c09",
    "build_date" : "2017-08-14T12:33:14.154Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.0"
  },
  "tagline" : "You Know, for Search"
}

JVM version:

openjdk version "1.8.0_111"
OpenJDK Runtime Environment (build 1.8.0_111-8u111-b14-2~bpo8+1-b14)
OpenJDK 64-Bit Server VM (build 25.111-b14, mixed mode)
2

It looks like your jvm certs are messed up. I would try updating them.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.