Spanish cadastre tiles failing to load (PKIX path building failed)

[Yonseca@…]

What steps will reproduce the problem?

1. Download any zone covered by the Spanish Cadastre (anyone in Spain)
2. Add Catastro Spain imagery (Imagery -> Map -> Catastro Spain)
3. Tiles won't load and "PKIX path building failed" error will show up (see attached image)

What is the expected result?

Spanish Cadastre tiles should appear.

What happens instead?

Only cached tiles will appear, if any. Also, there's an error as tiles can't be loaded. Flushing tile cache didn't work.

Please provide any additional information below. Attach a screenshot if possible.

Relative:URL: ^/trunk
Repository:UUID: 0c6e7542-c601-0410-84e7-c038aed88b3b
Last:Changed Date: 2022-04-04 22:26:00 +0200 (Mon, 04 Apr 2022)
Revision:18427
Build-Date:2022-04-05 01:30:55
URL:https://josm.openstreetmap.de/svn/trunk

Identification: JOSM/1.5 (18427 es) Linux Arch Linux
Memory Usage: 230 MB / 4004 MB (49 MB allocated, but free)
Java version: 18.0.1+10, N/A, OpenJDK 64-Bit Server VM
Look and Feel: javax.swing.plaf.metal.MetalLookAndFeel
Screen: :0.0 1920×1080 (scaling 1.00×1.00) :0.1 1080×1920 (scaling 1.00×1.00)
Maximum Screen Size: 1920×1920
Best cursor sizes: 16×16→16×16, 32×32→32×32
Environment variable LANG: es_ES.UTF-8
System property file.encoding: UTF-8
System property sun.jnu.encoding: UTF-8
Locale info: es_ES
Numbers with default locale: 1234567890 -> 1234567890
Desktop environment: GNOME
Dataset consistency test: No problems found

Last errors/warnings:
- 00150.370 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00150.370 W: Already here sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00150.372 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00150.372 W: Already here sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.594 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.594 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.594 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.613 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.615 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00379.615 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Causa: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[Yonseca@…]

Screenshot

[taylor.smock]

Ticket #22051 has been marked as a duplicate of this ticket.

[anonymous]

Since the other report – # 22051 – was closed while asking a question, I assume I should answer here.

My /etc/alternatives/java pointed to /opt/Oracle_Java/jre1.8.0_51/bin/java – whyever that was the case. Chosing /usr/lib/jvm/java-11-openjdk-amd64/bin/java solves the issue, and openjdk-18 is also available and also works perfectly.

(Now I'm interested to see what other program fails with this Java version.)

Thanks.

[taylor.smock]

It looks like the root certificate may not be present in the system installation.

I was able to reproduce on Ubuntu.

It looks like the AC RAIZ FNMT-RCM certificate authority is not in the Java certificate authority list.

It looks like we are trying to work around that already (see #18920, fixed in r16120). I'm going to have to see what is going on here.

[skyper]

See also #21592.

[taylor.smock]

Closed as duplicate of #21592.

[taylor.smock]

@yonseca: The server administrators for the service have to fix their server (possibly point them at ​https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#21-use-complete-certificate-chains and ​https://www.ssllabs.com/ssltest/analyze.html?d=ovc.catastro.meh.es). See comment:12:ticket:21592.

If you know how to contact the server administrators for the imagery service, please do so. And let us know in #21592 so that multiple people aren't contacting them.

[Davileci]

Any zone covered by the Spanish Cadastre is not anyone in Spain: Navarre, Biscay, Gipuzkoa and Álava have their own cadastres.