Aws-toolkit-jetbrains: Certification Path Error while selecting credentials

[pabloariasmora]

Describe the bug
AWS Explorer showing this error after select credentials

Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

To reproduce
1) Install latest plugin using this steps https://github.com/aws/aws-toolkit-jetbrains#eap-builds
2) Create the credential files (files already tested using awscli)
3) Click over Configure AWS connection
4) Select a valid profile
5) Error should appear on the event log.

Expected behavior
AWS Explorer should show the Stacks and the Lambdas out there.

Your Environment

• OS: Windows 10 10.0
• JetBrains' Product: IntelliJ IDEA 2019.1.3 (Ultimate Edition)
• JetBrains' Product Version: Build #IU-191.7479.19, built on May 27, 2019
• Toolkit Version: 1.4 EAP Builds
• SAM CLI Version: =0.17.0
• JVM/Python Version: OpenJDK 64-Bit Server VM by JetBrains s.r.o/ Python 3.7

Additional context

• Also tested it using the plugin in the market.

[abrooksv]

Do you use any custom system properties or environment variables? We run the same setup and have not seen these issues.

Is your IDE running with JBRE 8 or JBRE 11?

[pabloariasmora]

@abrooksv thanks for looking at this.

No I don't have any system properties, here is the complete about window information

IntelliJ IDEA 2019.1.3 (Ultimate Edition)
Build #IU-191.7479.19, built on May 27, 2019
Licensed to Juan Arias
Subscription is active until February 22, 2020
JRE: 1.8.0_202-release-1483-b58 amd64
JVM: OpenJDK 64-Bit Server VM by JetBrains s.r.o
Windows 10 10.0

[abrooksv]

Do you have any changes in idea.vmoptions or idea.properties? (Accessible through the Help menu)

[pabloariasmora]

I don't have any idea.properties or idea64.exe.vmoptions, once I click the help menu option a popup appears with option to create them.

[abrooksv]

Sorry for all the questions, trying to figure out what differs between our set up and yours.

Do you use an HTTPS proxy configured in the IDE's proxy settings page?

[pabloariasmora]

np, I can provide all the details that need.

No I don't have any proxy setting enabled.

[abrooksv]

I am not sure what is the difference then. It boils down to the trust store appears to be missing Amazon's root CAs it appears. What I don't understand is that you are using JetBrain's JRE which should contain it. (We use the same JRE)

There is some info here that may help diagnose it: https://github.com/aws/aws-sdk-java/issues/1757

[pabloariasmora]

Ok, let me test this an get back to you 👍

[abrooksv]

Closing due to no response, please re-open if you still have issues

[schapsl]

Hi...
I found this page searching for my problem.
I do have a proxy service called ZScaler doing https inspection (yes, I know, tell me about it).
However, I'm kind of getting used to installing certificates into truststores, but I cannot find out which truststore is actually used by the aws-toolkit-jetbrains to do the AWS calls. Please help me. Thank you.
Lars

[zladuric]

@larsschaps did you figure out which store you need to add the zscaler to?

[schapsl]

Hi @zladuric , no, sorry, i gave up searching. If you could tell me, i would be very happy.

Thanks,
Lars

[abrooksv]

You would need to find the JBR trust store that IntelliJ is using, we have not added the ability to trust the certs managed through the UI yet.

[schapsl]

Hi @abrooksv , thank you for your answer. You are saying that IntelliJ is using another trust store besides the one, i can install certificates into via File -> Settings -> Tools -> Server Certificates, right? - Because this way the ZScaler certificate is already installed.
This would be somewhere inside the installation directory?
I will go looking for it.
Wish me luck.
Thanks,
Lars

[schapsl]

Hi @abrooksv , thumps up. It's working now.
Found it in
C:\Program Files\JetBrains\IntelliJ IDEA 2019.3.1\jbr\lib\security\cacerts
But I guess a major IntelliJ update and I have to do this again, right?

brgs
Lars

[serverhorror]

@larsschaps I am in the same situation (also using zScaler in the enterprise). Go to Help -> Edit Custom VM Options and add that line:

-Djavax.net.ssl.trustStore=C:/Users/.../src/cacerts

I just copied the "main" truststore and added the required certs. That did the trick

[abrooksv]

SDK change is required https://github.com/aws/aws-sdk-java-v2/pull/1608 before we can enable in the IDE

[abrooksv]

@larsschaps @serverhorror

We have just released a new EAP build (2019.3: https://plugins.jetbrains.com/plugin/11349-aws-toolkit/update/77855, 2019.2: https://plugins.jetbrains.com/plugin/11349-aws-toolkit/update/77854) that will use the IDE's certificate preferences so you no longer need to edit the trust store yourself.

Please give it a try if you have time.

[abrooksv]

Support has been released into 1.11 version of the toolkit