PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Training
1

I am trying to run the nf-core/demo on my local computer (company server) and I get this issue in the log:

DEBUG io.seqera.http.HxClient - HTTP request retry attempt 1:
  (certificate_unknown) PKIX path building failed:
  `*`sun.security.provider.certpath.SunCertPathBuilderException`*`: 
  unable to find valid certification path to requested target

Which results in ERROR nextflow.cli.Launcher - Conversion = '4'

How can I resolve this issue?

I am using:

  • nextflow 25.10.4
  • nf-core, version 3.4.1
  • openjdk version “23.0.2-internal” 2025-01-21
2

Hi @b-brankovics,

This is an odd one! My first thought it that it sounds like some kind of network traffic blockage. Are you able to try again with a mobile hotspot or something, check if your company server firewall is getting in the way of something?

Phil

3

Hi @ewels,

Thank you. You are probably right. It works on another network. I was hoping to have a temporary solution while our IT comes back with more info on the firewall or CA certificates.

4

Sorry, not much we can do from our side. Good luck!

5

I have found how to get the certificates that are needed and add them to the trusted list.

In my setup, I am working in a conda environment and I used this cacert path $JAVA_HOME/lib/security/cacerts (some sources had jre/ before lib)

# debug run of the pipeline
NXF_DEBUG=3 NXF_OPTS="-Djavax.net.debug=ssl,handshake" nextflow run core-hello --outdir core-hello-results -profile test,conda 2>log
# checked the log for "type=host_name (0), value=<target>"
echo "" | openssl s_client -connect <target>:443 -showcerts 2>/dev/null | openssl x509 -out testcertfile.txt
# Change the alias
keytool -import -trustcacerts -alias <alias> -file testcertfile.txt -keystore $JAVA_HOME/lib/security/cacerts

Repeat until you collect and add all the necessary targets. For me, they were: registry.nextflow.io and public-cr-prod.seqera.io

Hope this helps others :slight_smile:

6

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.