PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 根证书

[jongwong]

错误描述

`
// 创建 autoCertificateConfig 配置
RSAAutoCertificateConfig autoCertificateConfig = new RSAAutoCertificateConfig.Builder()
.merchantId(merchantId) // 商户号
.privateKeyFromPath(privateKeyPath) // 商户私钥路径
.merchantSerialNumber(merchantSerialNumber)
.apiV3Key(apiV3Key) // 商户证书序列号
.build();

 // 创建 JsapiService，传入 rsaConfig 和 certificateProvider
    JsapiService jsapiService = new JsapiService.Builder()
            .config(autoCertificateConfig)  // 使用 autoCertificateConfig 配置
            .build();

`

com.wechat.pay.java.core.exception.HttpException: Send Http Request failed,httpRequest[{"http_method":"GET","url":"https://api.mch.weixin.qq.com/v3/certificates?algorithm_type=RSA","uri":"https://api.mch.weixin.qq.com/v3/certificates?algorithm_type=RSA","headers":{"headers":{"Authorization":"WECHATPAY2-SHA256-RSA2048 mchid=\"1704006353\",nonce_str=\"t2GSJ3wl0MWwTE7r6aZJw2XiliXkpUUT\",timestamp=\"1739735598\",serial_no=\"7E92F76242E500317FF50E2DE4F02C5D105A2853\",signature=\"nZ2HkZQcR6hrmMx8ng1FY0cR5MGpaoUEdBLZNe4tno1udC3rTMZB+25rzHrJKGgc7+TsZlRowZoKPdtqlVkTOLrNc3JAMx07xjYnS/+lRVGy7No/wuvwd9HUwhrJIBnETWqu4LB+JeLVoZKH8HPs2vu4AqLoGORJB8pBBClvxVLeWxqRsRTNdkxegD9WeGOvKshx+rViIbc/n5ZFe1xuhy+M7loYtPPxmIEu6Vz1bS+r8LL1Mw/SPO/HcaF/SVVDr4paoWjzD2kUhIuauVM31VEUX4ouzNqah2wSDFnmC/z9s6lAkH71LaIc96zXv+A4OWWaKA2kkP81IOgzsp5iog==\"","Accept":" */*","User-Agent":"WechatPay-Java/0.2.16 (Mac OS X/12.4) Java/17.0.13 Credential/WechatPay2Credential Validator/ okhttp3/null","Content-Type":"application/json","Wechatpay-Serial":""}}}]

	at com.wechat.pay.java.core.http.okhttp.OkHttpClientAdapter.innerExecute(OkHttpClientAdapter.java:52)
	at com.wechat.pay.java.core.http.AbstractHttpClient.execute(AbstractHttpClient.java:46)
	at com.wechat.pay.java.core.certificate.CertificateDownloader.download(CertificateDownloader.java:82)
	at com.wechat.pay.java.core.certificate.AutoCertificateService.lambda$register$0(AutoCertificateService.java:66)
	at com.wechat.pay.java.core.certificate.AutoCertificateService.register(AutoCertificateService.java:72)
	at com.wechat.pay.java.core.certificate.RSAAutoCertificateProvider.<init>(RSAAutoCertificateProvider.java:40)
	at com.wechat.pay.java.core.certificate.RSAAutoCertificateProvider.<init>(RSAAutoCertificateProvider.java:19)
	at com.wechat.pay.java.core.certificate.RSAAutoCertificateProvider$Builder.build(RSAAutoCertificateProvider.java:139)
	at com.wechat.pay.java.core.RSAAutoCertificateConfig$Builder.build(RSAAutoCertificateConfig.java:117)
	at cn.jongwong.server.OauthServerApplicationTest.testDemo2(OauthServerApplicationTest.java:206)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1351)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1226)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1169)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
	at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:379)
	at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:337)
	at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:209)
	at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
	at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
	at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
	at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
	at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154)
	at com.wechat.pay.java.core.http.okhttp.OkHttpClientAdapter.innerExecute(OkHttpClientAdapter.java:49)
	... 12 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
	... 41 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
	... 46 more

好像跟下面有关根证书有关 https://developers.weixin.qq.com/community/develop/article/doc/0002284c6948c066ad919a2bc67813

执行了keytool -importcert -keystore /Users/jongwong/Library/Java/JavaVirtualMachines/corretto-17.0.13/Contents/Home/lib/security/cacert -storepass changeit -noprompt -file ./DigiCertGlobalRootG2.crt -alias digicertglobalrootg2
证书已添加到密钥库中 还是不行

重现bug的步骤

2

预期行为

2

导致错误的代码片段

操作系统

macos

Java 版本

17

wechatpay-java 版本

0.2.16

其他信息

No response