Bazel does not honor custom CA certificates

Description of the problem:

When I try to use Bazel in an environment with TLS only working with custom CA certificates, it does not work (e.g. download dependencies).

One of the errors is:

ERROR: An error occurred during the fetch of repository 'zlib':
   java.io.IOException: Error downloading [https://zlib.net/zlib-1.2.11.tar.gz] to /home/abergmei/.cache/bazel/_bazel_user/a05519119102d261558210037d2dc4c6/external/zlib/zlib-1.2.11.tar.gz: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Bugs: what’s the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Have a non-rooted CA, which intercepts all HTTPS calls in your network.

What operating system are you running Bazel on?

Ubuntu 18.04

What’s the output of bazel info release?

release 1.2.1

Have you found anything relevant by searching the web?

Any other information, logs, or outputs that you want to share?

Tried executing via JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64 bazelisk build --host_javabase '@local_jdk//:jdk' //mytarget but the error persists. Not sure though, that it really uses my local JDK.

Is there any way of forcing the bundled JDK to use a certs database outside of Bazel?

[mcarpenter]

Similar issue is #5741.

That issue contains a clean workaround that is still valid for Ubuntu 20 and Bazel 4.0.0. That is, in your .bazelrc add:

startup --host_jvm_args=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts \
        --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit

[jgallucci32]

Same problem on RHEL7. Guess there aren’t too many of us on the internet using Bazel behind an SSL gateway. We typically symlink cacerts to the one which is updated with ca-certificates on Red Hat images with our custom SSL certs.