#1528 [eclipse] Unable to read repository at https://sourceforge.net/projects/pmd/files/pmd-eclipse/update-site/content.xml.

[Charles]

Hi,
I am using STS 3.7.2.RELEASE (tried Juno Service Release 2 also).
When I tried to install PMD bellow expetion is show.
Unable to read repository at https://sourceforge.net/projects/pmd/files/pmd-eclipse/update-site/content.xml.
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Please help me on this.

[Andreas Dangel]

The error indicates that the Java runtime doesn't trust the SSL certificate sourceforge is using. Since sourceforge is now redirecting to https always, the working to use an unsecured URL is not possible anymore.

Can you verify, that your eclipse installation is running with the latest Java runtime or JDK? (java 8 update 101/102). The Java runtime bundles the certificate store and should contain the root certificate for GeoTrust, that sourceforge is using.
You might need to configure eclipse to use the new java version.
Also, verify that you can open the URL with your web browser: https://sourceforge.net/projects/pmd/files/pmd-eclipse/update-site/ - if this doesn't work, you might have a network / firewall problem - and a java update won't help.

[Charles]

Hi Andreas,
I am uding Java 8. pls find the conf details from eclipse.

java.net.preferIPv4Stack=true
java.runtime.name=Java(TM) SE Runtime Environment
java.runtime.version=1.8.0_102-b14
java.specification.name=Java Platform API Specification
java.specification.vendor=Oracle Corporation
java.specification.version=1.8
java.vendor=Oracle Corporation
java.vendor.url=http://java.oracle.com/
java.vendor.url.bug=http://bugreport.sun.com/bugreport/
java.version=1.8.0_102
java.vm.info=mixed mode
java.vm.name=Java HotSpot(TM) 64-Bit Server VM
java.vm.specification.name=Java Virtual Machine Specification
java.vm.specification.vendor=Oracle Corporation
java.vm.specification.version=1.8
java.vm.vendor=Oracle Corporation
java.vm.version=25.102-b14
line.separator=

I am able to install other plugins, i dont think it is a firewall problem.

[Andreas Dangel]

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Means, that java could not trust the TLS connection to the update site (https://sourceforge.net/projects/pmd/files/pmd-eclipse/update-site).

There are a couple of possibilities, that come into mind:

1. Oracle Java doesn't come with the root certificate for GeoTrust (The certificate of sourceforge.net is issued by GeoTrust)
2. The download site redirects to a mirror which an invalid certificate
3. You are behind a firewall, that sniffes encrypted network connections by replacing certificates with self-signed certificates (e.g. needed in order to check websites for malware before displaying in the browser).
4. You are suffering from a man-in-the-middle attack

To verify #1, have a look at the file jre/lib/security/cacerts in your jdk/jre installation:

keytool -list -v -keystore jre/lib/security/cacerts -storepass changeit|grep "CN=GeoTrust Global CA"
Owner: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
Issuer: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

If it doesn't yield the lines Owner and Issuer, then your Java installation doesn't know about the GeoTrust certificate.

I've just tried to install pmd-eclipse with Luna SR2, and I didn't have a problem downloading pmd-eclipse...

To verify #3, open https://sourceforge.net/projects/pmd/files/pmd-eclipse/update-site - is the connection symbol green? (e.g. encryption is safe?)

[Charles]

Thanks for the reply Andreas.
I could install other plugins such as Eclemma, Moreunit, etc.
Also I have checked the JRE path and cacerts file, the content is junk but i could search "GeoTrust Global CA" from there.
Do you think it is the problem with network?

[Andreas Dangel]

You might try to use "http://netassist.dl.sourceforge.net/project/pmd/pmd-eclipse/update-site/" - this is a specific mirror... or from "http://freefr.dl.sourceforge.net/project/pmd/pmd-eclipse/update-site/", which is another mirror.
If this works, then problem is somehow with #2 - the mirrors...

[Charles]

Thanks Andreas..
This link worked for me -- http://netassist.dl.sourceforge.net/project/pmd/pmd-eclipse/update-site/

[Andreas Dangel]

Alternatively, the update site is also available as a zip archive for offline installations. The zip archive is available from the releases on github:
https://github.com/pmd/pmd-eclipse-plugin/releases

[Andreas Dangel]

Just ran into the same issue when trying to install eclipse-cs (checkstyle).
Here is more info:
https://sourceforge.net/p/forge/site-support/14016/ and https://www.topjavablogs.com/news/how-to-trust-lets-encrypt-certificate-with-java

Since Java 8u101 is Let's encrypt trusted! YAY!