Maven "PKIX path building failed" (TLS) to Repo - Fix in CI
By Kaveh Alemi·Latchkey
Maven could not validate the TLS certificate of the repository. The JVM truststore has no chain to the certificate authority that signed it - common behind a TLS-intercepting corporate proxy or with an internally signed Nexus.
What this error means
A transfer fails with PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. The host is reachable; the certificate is the problem.
mvn output
[ERROR] Failed to execute goal ... Could not transfer artifact
com.example:lib:jar:1.0.0 from/to internal (https://nexus.example.com):
PKIX path building failed: unable to find valid certification path
to requested target
Common causes
CA not in the JVM truststore
An internal CA or a self-signed Nexus certificate is not in cacerts, so the JVM cannot build a trust chain and rejects the connection.
TLS-intercepting proxy re-signs traffic
A corporate proxy presents its own certificate for outbound HTTPS. Without the proxy CA imported, every repository transfer fails certificate validation.
How to fix it
Import the CA into the JVM truststore
Add the repository or proxy CA to cacerts so the JVM trusts it.
Bake the internal/proxy CA into the runner truststore and resolve through a stable mirror so certificate trust is established once, not per build.
Frequently asked questions
What causes ""PKIX path building failed""?
An internal CA or a self-signed Nexus certificate is not in cacerts, so the JVM cannot build a trust chain and rejects the connection.
How do I fix "PKIX path building failed"?
Add the repository or proxy CA to cacerts so the JVM trusts it.
Can Latchkey fix this automatically?
Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.
