How to get rid of the pesky Gradle certificate error

So you set up your Android Studio in your Windows workstation. You download the trimmings, the emulator, and the nice SDK Build Tools. All seems to go well. You make your first project, and then suddenly, you get greeted by this Gradle Sync error:

ERROR: Cause unable to find valid certification path to requested target

Or this one:

Unable to resolve dependency for ':app@debug/compileClasspath': Could not resolve com.your.desired:dependency-vx:x.x.x.

If you will inspect your stacktrace closely, your IDE may tell you that it is thus unable to resolve your dependencies due to an SSLHandshakeException.

SSLHandshakeException: sun.secutiry.validator.ValidatorException: PKIX path building failed… unable to find valid certification path to requested target.

Sometimes a veritable Android Studio update or a Gradle version update is in order: https://stackoverflow.com/questions/26697118/android-studio-unable-to-find-valid-certification-path-to-requested-target

Sometimes you just need to Invalidate Caches and Restart.

But if you’re in corporate like me, who has to use Microsoft Windows and go through a company firewall, it is likely that you had not included JCenter’s website certificate in your collection of approved certificates, or your cacertsfile.

Thus, to be able to proceed as normal you need to do the following:

Export and download JCenter’s certificate.

We choose JCenter because it is the link mentioned in the stacktrace. Strip the stacktrace link of the .pom file and download the certificate into your local storage like as follows:

Click OK…
Copy to File…

Just go through the wizard as normal if you don’t need to do anything fancier…

Save your certificate into any directory where you can easily pick it up later on:

Save your new certificate with an extension of .cer

Then, mind your Android Studio’s version of JDK. It should have a cacertsfile somewhere in your JDK. You see, the cacerts file contains the certificates that Java’s Secure Socket Extension lets through.

With the company firewall in mind, plus an improperly-configured server, the server just sends the leaf certificate over to your local machine but somehow forgets the rest of the chain certificates. Your JCenter somehow got lost. The long explanation is here (https://security.stackexchange.com/questions/162592/why-do-i-need-to-add-intermediate-ca-certificates-to-jvms-cacerts-file)

Run your CLI app as Administrator

Thus for your [Android Studio’s choice of] JVM to recognize JCenter, you need to Run your choice of Command Line application (I prefer PowerShell) as Administrator and run this command:

keytool -import -alias certificatename -keystore ‘C:\Path\to\your\jdk\jre\lib\security\cacerts’ -file path\to\your\exported\certificate\certificatename.cer

You will be asked for a password. Enter it. (normally it’s changeit), then just say yes or y.

yes

Restart your Android Studio, then sync again.

Some caveats

As mis-configured networks often forget to give you entire certificate chains, you may want to add to your cacerts file from time to time, especially whenever you add new dependencies to your Android project.

Happy coding!

Leave a Reply