Failed to Verify the Certificate When Compiling TensorFlow 1.15.5

Symptom

When running the TensorFlow 1.15.5 compilation command, a message is displayed stating "unable to find valid certification path to requested target":

Key Process and Cause Analysis

Key error information: The valid certificate path of the requested target is not found when downloading the dependency.

1

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Conclusion and Solution

1. Export the certificate using a browser.

   Use a browser (for example, Google Chrome) to visit https://github.com, and export and save the certificate as a .crt file, for example, ca.crt, as illustrated in the following figure.

   

2. Import the certificate exported from the browser to the server.
   1. Upload the certificate to the server.
   2. Import the certificate.

      1	keytool -import -alias ca -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts -file ca.crt -trustcacerts -storepass changeit -noprompt

      

      • Parameter description:
        • -alias: specifies the alias (user-defined).
        • -keystore: specifies the storage file, which is stored in the java/lib/security directory. (Replace this directory with the actual one.)
        • -file: specifies the certificate file (absolute path + file name).
        • -storepass: specifies the storage password. It is changeit by default. This password is required when you query or delete configurations.
        • -trustcacerts: adds the trusted CA certificate to the keystore.
        • -noprompt (optional): disables the prompt message.
      • The default password of the cacerts certificate store is changeit. (If the password has been changed, use the new password.)
   3. Check whether the certificate is successfully imported.

      1	keytool -list -storepass changeit -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts | grep -w ca

      

      If the alias exists in the command output, the certificate is successfully imported.

      

      To delete the certificate, run the following command:

      1	keytool -delete -storepass changeit -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts -alias ca

   4. Restart the device.

      reboot

3. After the device is restarted, reconfigure the TensorFlow compilation options.
   1. Configure a network proxy. See Configuring a Network Proxy.
   2. Configure the pip repository.

      1 2	pip config set global.index-url https://mirrors.huaweicloud.com/repository/pypi/simple pip config set global.trusted-host mirrors.huaweicloud.com

   3. Add the Bazel information to the environment variables.

      1	export PATH=/path/to/bazel/bazel-0.26.1/output:$PATH

   4. Add the Python information to the environment variables.

      1 2	export LD_LIBRARY_PATH=/usr/local/python3.7.5/lib:$LD_LIBRARY_PATH export PATH=/usr/local/python3.7.5/bin:$PATH

4. Recompile TensorFlow.

   1	bazel build --config=v1 --cxxopt="-D_GLIBCXX_USE_CXX11_ABI=0" //tensorflow/tools/pip_package:build_pip_package