ARTIFACTORY: How to Resolve Gradle Build Failures with HTTPS When Artifactory Domain Uses a Self-Signed Certificate

Description: 

When your Artifactory domain uses a self-signed certificate, executing Gradle commands (e.g., “gradle build“) to pull dependencies from Artifactory via HTTPS may fail with errors. Taking the artifact "org.springframework.boot:spring-boot-gradle-plugin:3.2.12" as an example, the error may appear as follows:

...
* What went wrong:
Plugin [id: 'io.spring.dependency-management', artifact: 'org.springframework.boot:spring-boot-gradle-plugin:3.2.12'] was not found in any of the following sources:

- Gradle Core Plugins (plugin is not in 'org.gradle' namespace)
- Included Builds (No included builds contain this plugin)
- Plugin Repositories (could not resolve plugin artifact 'org.springframework.boot:spring-boot-gradle-plugin:3.2.12')
  Searched in the following repositories:
    MavenLocal(file:/Users/xxx/.m2/repository)
    maven(https://<artifactory_url>/artifactory/maven-virtual/)
...

The error shows that the dependency could not be resolved from the Artifactory repository, even though the dependency package is confirmed to exist in the repository. And also, it can be resolved via HTTP.
This article will guide you through how to solve this issue.


Root Cause:

Although the error message shows that it does not relate to certificate issues, comparing the results of HTTPS and HTTP requests confirms that the problem is caused by HTTPS. The root cause is that the JDK used by Gradle does not trust this self-signed certificate.


Solution:

This issue can be solved by importing the self-signed certificate into the JDK's cacerts keystore. Here are the steps:

1. Obtain the self-signed certificate using the following command, for example:

openssl s_client -connect artifactory.example.com:443 -showcerts < /dev/null > server.ca

2. Locate the JDK certificate path and import the certificate:

keytool -import -alias myca -keystore /usr/lib/jvm/java-1.8.0-openjdk-amd64/jre/lib/security/cacerts -trustcacerts -file server.ca


Password: changeit

Confirm adding the certificate.

3. Re-run the "gradle build" command. The dependency should now be successfully resolved.