Maven "PKIX path building failed" (TLS) - Fix Repository Trust
By Daniel Zoghalchali·Latchkey
Maven made an HTTPS connection to the repository, but the JDK could not build a trust chain to a root CA it knows. The certificate is fine; the JVM truststore simply does not contain the issuing CA.
What this error means
Resolution from an HTTPS repo fails with PKIX path building failed: ... unable to find valid certification path to requested target. Public Central often works while an internal Nexus or a TLS-intercepting proxy fails.
mvn output
[ERROR] Failed to execute goal ... Could not transfer artifact
com.example:lib:jar:2.3.1 from/to nexus (https://nexus.example.com/...):
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
Diagnose it: resolve the effective POM first
Maven merges parent POMs, profiles, and settings before it builds anything. The configuration causing your failure is frequently inherited or activated by a profile that is on locally and off in CI.
Terminal
# the fully resolved configuration Maven will actually use
mvn help:effective-pom | head -60
# which profiles are active here vs on your machine?
mvn help:active-profiles
# full error, offline-safe, no colour codes to confuse the log
mvn -B -e -X <goal> 2>&1 | tail -60
Common causes
Internal CA not in the JDK truststore
A private Nexus/Artifactory signed by a corporate CA is not trusted by the default cacerts, so the JVM cannot validate the chain.
TLS-intercepting proxy re-signs traffic
A man-in-the-middle proxy (Zscaler, corporate firewall) replaces the server cert with its own. Without that proxy CA imported, every HTTPS transfer fails PKIX validation.
How to fix it
Import the CA into a truststore
Add the repository or proxy CA to the JDK truststore (or a custom one) so the chain validates.
Bake the corporate/proxy CA into the CI runner image or a versioned truststore.
Prefer a custom truststore via MAVEN_OPTS over mutating the JDK cacerts.
Document which repos sit behind a TLS-intercepting proxy.
Frequently asked questions
What causes Maven "PKIX path building failed" (TLS)?
There are 2 common causes: internal ca not in the jdk truststore and tls-intercepting proxy re-signs traffic. A private Nexus/Artifactory signed by a corporate CA is not trusted by the default cacerts, so the JVM cannot validate the chain.
How do I fix Maven "PKIX path building failed" (TLS)?
There are 2 fixes depending on which cause you have: import the ca into a truststore and point maven at a custom truststore. Work through them in order, since the first is the most common.
What does Maven "PKIX path building failed" (TLS) actually mean?
Resolution from an HTTPS repo fails with PKIX path building failed: ...
How do I stop Maven "PKIX path building failed" (TLS) happening again?
Bake the corporate/proxy CA into the CI runner image or a versioned truststore. The prevention section lists 3 changes that keep it from recurring.
