Recent changes to 350: SSL/TLS error prevented download of tile

#350 SSL/TLS error prevented download of tile

r_x — Wed, 10 Feb 2021 14:07:39 -0000

The grade of the server is not relevant. Look at the detail result especially on the cert chain.

You are on Linux and you use SunJRE!?

OpenJDK is IMHO at the moment the most preferred Java version to use. SunJRE is dead because of license restrictions and Java 8 is getting a bit old.

#350 SSL/TLS error prevented download of tile

rtfm — Wed, 10 Feb 2021 14:00:40 -0000

An interesting point is that using OpenJDK is avoiding the problem:

openjdk version "11.0.10" 2021-01-19
OpenJDK Runtime Environment (build 11.0.10+9-Ubuntu-0ubuntu1.20.04)
OpenJDK 64-Bit Server VM (build 11.0.10+9-Ubuntu-0ubuntu1.20.04, mixed mode, sharing)

#350 SSL/TLS error prevented download of tile

rtfm — Wed, 10 Feb 2021 13:56:31 -0000

Checking the server with the URL you provided returns A grade for all 4 IP's.
So it is not the certificate chain itself.

#350 SSL/TLS error prevented download of tile

r_x — Wed, 10 Feb 2021 13:18:01 -0000

Some servers are configured wrong and even if the root CA certificate is trusted they forget to send the intermediate certificates. Firefox is so kind to provide an own large intermediate CA store to fix such problems. Java does not provide such a service to correct defect HTTPS servers.

Most likely this is the problem.
You can test the server regarding SSL/TLS problems: https://www.ssllabs.com/ssltest/

SSL/TLS error prevented download of tile

rtfm — Wed, 10 Feb 2021 13:14:18 -0000

I get the following error by accessing the WMS server:

ERROR - SSL error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
WARN - SSL/TLS error prevented download of tile 10/535/362@<snip/>: <snip/>: java.security.cert.CertificateException: Untrusted certificate encountered: publicKeyHash="<snip/>"; certificate issued for <snip/>

I suspect a java keystore problem, but cannot find which keystore is involved.
The certificate chain is valid: I can fetch tiles with Firefox and check that the certificates are trusted.

java version "1.8.0_281"
Java(TM) SE Runtime Environment (build 1.8.0_281-b09)
Java HotSpot(TM) 64-Bit Server VM (build 25.281-b09, mixed mode)

Running Linux Mint 20.1