download tests fail in Scala 2.12 community build on OpenJDK 10

[SethTisue]

I'm not sure if this is two problems or one problem, but at e.g. https://scala-ci.typesafe.com/view/scala-2.12.x/job/scala-2.12.x-jdk10-integrate-community-build/56/consoleFull and in other runs we consistently see:

[gigahorse] [info] - should retrieve a resource from Wikipedia *** FAILED ***
[gigahorse] [info]   java.net.ConnectException: General SSLEngine problem
...
[gigahorse] [info]   Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

and then a bit later the whole thing hangs until Jenkins times out:

[gigahorse] [info] http.download
Build timed out (after 15 minutes). Marking the build as aborted.

[xuwei-k]

reproduce in travis-ci

• https://github.com/xuwei-k/gigahorse/commit/d63ea19f220dd51fc3f5c6e777174b0dd9fed30a
• https://travis-ci.org/xuwei-k/gigahorse/jobs/402927553#L779

workaround in travis-ci

• https://github.com/xuwei-k/gigahorse/commit/7a6461f56607596610b1e175fd2fe078eecc3671
• https://github.com/travis-ci/travis-ci/issues/9368#issuecomment-395470644

[xuwei-k]

succeeded with oraclejdk10

• https://travis-ci.org/xuwei-k/gigahorse/builds/402931514
• https://github.com/xuwei-k/gigahorse/commit/b06c56fb64fc48f709798d0572386ff3e3dc137a

[eed3si9n]

Potentially related:

• Error - trustAnchors parameter must be non-empty - https://stackoverflow.com/a/50103533/3827
• 9-jdk image has SSL issues https://github.com/docker-library/openjdk/issues/145
• JEP 229: Create PKCS12 Keystores by Default - http://openjdk.java.net/jeps/229
• Ubuntu 1770553: [SRU] backport ca-certificates-java from cosmic (20180413ubuntu1) - https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1770553

So the cert store can be in JKS format, PKCS12 format with empty password, or PKCS12 format with the password set to changeit?

[SethTisue]

https://github.com/scala/community-builds/pull/840

[SethTisue]

(not sure whether this got fixed because we're on JDK 11 now, or what)