[MNG-7687] Ignoring SSL using -Dmaven.wagon.http.ssl.insecure=true not working on 3.9.0

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.9.0
• Component/s: Core
• Environment: MacOS 13.2 ; Java version: 1.8.0_362, vendor: BellSoft ; Windows 10 ; jdk-8.0.322.6-openj9
• Assignee: Unassigned
• Reporter: Thibaud Lepretre
• Created: 09/Feb/23 10:47
• Updated: 09/Feb/23 12:30
• Resolved: 09/Feb/23 12:30

Description

Until now, we disabled SSL checks using following system variables:

-Dmaven.wagon.http.ssl.insecure=true 
-Dmaven.wagon.http.ssl.allowall=true
-Dmaven.wagon.http.ssl.ignore.validity.dates=true

but since 3.9.0 it does not work anymore

I've tried directly on command line

mvn compile -Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true -Dmaven.wagon.http.ssl.ignore.validity.dates=true -X

but fail with

Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact com.mygroupid:anotherdep:pom:1.0.0 from/to nexus-public (https://nexus.our.nexus.url/repository/maven-public/): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

See attached error for complete stacktrace

I've tried on different env (mac/windows) and different JVM (but all on 8)

Issue Links

• duplicates: MNG-7685 Unable to ignore certificate errors with v3.9.0