--- title: 编译ScaNN过程中提示找不到证书路径的解决办法 description: "执行编译ScaNN命令过程中提示unable to find valid certification path to requested target详细信息如下：" url: https://www.hikunpeng.com/document/detail/zh/SRA/ecosystemEnable/ScaNN/kunpengscann_02_0014.html sourcePath: /source/zh/SRA/ecosystemEnable/ScaNN/kunpengscann_02_0014.html indexId: a1153ddc7b79b760b35cfe483d02b32532596387b94fb4b35c199cafc2cd54d262 --- # 编译ScaNN过程中提示找不到证书路径的解决办法 #### 问题现象描述 执行编译ScaNN命令过程中提示unable to find valid certification path to requested target详细信息如下： ``` bazel clean; CC=gcc bazel build -c opt --cxxopt="-std=c++17" --copt=-fsized-deallocation --copt=-w --copt=-O3 --cxxopt=-O3 --copt=-march=armv8.2-a+lse+sve+f64mm --cxxopt=-march=armv8.2-a+lse+sve+f64mm --copt=-msve-vector-bits=256 --cxxopt=-msve-vector-bits=256 :build_pip_pkg Extracting Bazel installation... Starting local Bazel server and connecting to it... INFO: Starting clean (this may take a while). Consider using --async if the clean takes more than several minutes. INFO: Repository bazel_skylib instantiated at: /home/wjh/scann/google-research/scann/WORKSPACE:21:13: in Repository rule http_archive defined at: /root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/external/bazel_tools/tools/build_defs/repo/http.bzl:355:31: in WARNING: Download from https://github.com/bazelbuild/bazel-skylib/releases/download/1.3.0/bazel-skylib-1.3.0.tar.gz failed: class javax.net.ssl.SSLHandshakeException PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderExcepti on: unable to find valid certification path to requested target ERROR: An error occurred during the fetch of repository 'bazel_skylib': Traceback (most recent call last): File "/root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/external/bazel_tools/tools/build_defs/repo/http.bzl", line 125, column 45, in _http_archive_impl download_info = ctx.download_and_extract( Error in download_and_extract: java.io.IOException: Error downloading [https://github.com/bazelbuild/bazel-skylib/releases/download/1.3.0/bazel-skylib-1.3.0.tar.gz] to /root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/external/bazel_sk ylib/temp14633894268973902114/bazel-skylib-1.3.0.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ERROR: /home/wjh/scann/google-research/scann/WORKSPACE:21:13: fetching http_archive rule //external:bazel_skylib: Traceback (most recent call last): File "/root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/external/bazel_tools/tools/build_defs/repo/http.bzl", line 125, column 45, in _http_archive_impl download_info = ctx.download_and_extract( Error in download_and_extract: java.io.IOException: Error downloading [https://github.com/bazelbuild/bazel-skylib/releases/download/1.3.0/bazel-skylib-1.3.0.tar.gz] to /root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/external/bazel_sk ylib/temp14633894268973902114/bazel-skylib-1.3.0.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ERROR: no such package '@bazel_skylib//': java.io.IOException: Error downloading [https://github.com/bazelbuild/bazel-skylib/releases/download/1.3.0/bazel-skylib-1.3.0.tar.gz] to /root/.cache/bazel/_bazel_root/feae8769a9a784fcce64ccb472ce84a7/extern al/bazel_skylib/temp14633894268973902114/bazel-skylib-1.3.0.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target INFO: Elapsed time: 15.322s INFO: 0 processes. FAILED: Build did NOT complete successfully (0 packages loaded) ``` #### 关键过程、根本原因分析 ScaNN编译过程中需要从https://github.com网站获取资源，Java程序通过HTTPS协议访问资源，存在安全证书校验流程，由于环境缺少证书导致资源无法获取。 #### 结论、解决方案及效果 1. 通过浏览器导出证书。 使用浏览器（本文以谷歌浏览器为例）访问https://github.com(https://github.com)，按照下图操作顺序导出保存证书，证书文件后缀为crt，例如ca.crt。 2. 将浏览器导出的证书导入到服务器。 a. 将证书上传服务器。 b. 导入证书。 1 keytool -import -alias ca -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts -file ca.crt -trustcacerts -storepass changeit -noprompt 导入证书命令参数说明： -alias：指定别名（用户可以自定义名称）。 -keystore：指定存储文件，在java/lib/security的目录下。（用户需要根据环境中实际路径指定）。 -file：证书文件（绝对路径+证书文件名）。 -storepass：指定存储密码，默认为changeit，查询或删除配置时，需要用到此密码。 -trustcacerts：表示将信任的CA证书添加到密钥库中。 -noprompt：可选项，关闭提示信息。 cacerts证书库默认密码为“changeit”（如果使用之前有修改过，则使用修改过的密码）。 c. 查看证书是否导入成功。 1 keytool -list -storepass changeit -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts | grep -w ca 回显信息显示存在对应别名，代表证书导入成功。 如果需要删除证书，可以执行以下命令。 1 keytool -delete -storepass changeit -keystore /usr/lib/jvm/java-11-openjdk-11.0.21.9-1.oe2203sp3.aarch64/lib/security/cacerts -alias ca d. 重启设备。 1 reboot 3. 重启设备后需重新配置ScaNN编译配置。 a. 请参见 配置网络代理 配置网络代理。 b. 设置pip源。 1 2 pip config set global.index-url https://mirrors.huaweicloud.com/repository/pypi/simple pip config set global.trusted-host mirrors.huaweicloud.com c. 将bazel添加到环境变量PATH中。 1 export PATH=/path/to/bazel/bazel-5.4.0/output:$PATH d. 将python3头文件路径添加到环境变量C_INCLUDE_PATH和CPLUS_INCLUDE_PATH中。 1 2 export C_INCLUDE_PATH=/usr/include/python3.9:$C_INCLUDE_PATH export CPLUS_INCLUDE_PATH=/usr/include/python3.9:$CPLUS_INCLUDE_PATH 4. 重新执行编译ScaNN命令。 1 bazel clean; CC=gcc bazel build -c opt --cxxopt="-std=c++17" --copt=-fsized-deallocation --copt=-w --copt=-O3 --cxxopt=-O3 --copt=-march=armv8.2-a+lse+sve+f64mm --cxxopt=-march=armv8.2-a+lse+sve+f64mm --copt=-msve-vector-bits=256 --cxxopt=-msve-vector-bits=256 :build_pip_pkg