Explanation

XWiki can fail to reach an HTTPS service, such as an extension repository, an LDAP directory or a mail server, and log a PKIX path building failure:

ERROR aultExtensionRepositoryManager - Failed to search on repository [store.xwiki.com:xwiki:https://store.xwiki.com/xwiki/rest] with query [org.xwiki.extension.repository.search.ExtensionQuery@78b5e254]. Ignore and go to next repository.
org.xwiki.extension.repository.search.SearchException: Failed to search extensions based on pattern []
...
Caused by: java.io.IOException: Failed to request [https://store.xwiki.com/xwiki/rest/repository/search?start=0&number=20&q=]
...
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

Cause

The Java runtime validates every HTTPS certificate against its own truststore, and refuses the connection when it cannot build a chain from the certificate the server presents to an authority that truststore holds. That truststore belongs to the Java installation and is unrelated to the authorities the operating system and the browsers trust, which is why the same address can open in a browser on the server and still fail from XWiki. Two situations commonly produce it: a proxy server that inspects TLS traffic and re-signs it with a private authority, and an internal service presenting a self-signed certificate.

Solution

Add the missing certificate authority to the truststore of the Java runtime XWiki runs on:

1. Obtain the certificate of the authority that signed the service's certificate, in PEM or DER form.
2. Import it into the truststore of that Java runtime, which asks for the truststore password (changeit unless it was changed):

   keytool -importcert -cacerts -alias my-internal-ca -file my-internal-ca.crt

3. Restart the servlet container, so that XWiki reads the truststore again.

Where the Java installation must stay untouched, -Djavax.net.ssl.trustStore and -Djavax.net.ssl.trustStorePassword point the Java runtime at a separate truststore file instead. They are set on the process running XWiki the same way as the proxy properties.

Related

• XWiki Behind a Proxy Server.
• Multiple Instances of XWiki in the Same Container.
• XWiki behind a Proxy Server.
• "File Path too Long" on Windows when Unzipping.