Attempting to download files using the vCF Download Tool (vdt) fails with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Attempting to download files using the vCF Download Tool (vdt) fails with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Ran command 'openssl s_client -connect dl.broadcom.com:443' will present certificate broadcom.com & intermediate device certificate its being signed with.

Environment

SDDC Manager

Cause

The SSL connection between the vdtmachine and Broadcom is being decrypted and re-encrypted by SSL interception software.

If you view the certificate advertised on the dl.broadcom.com website, it will be signed by a 3rd party internal CA. 

The vdt does not trust these 3rd party CAs by default, and will need to trust them in order to use the tool properly. 

Resolution

Download the CA certificates that are re-signing the dl.broadcom.com certificate, and import them into the 'cacerts' trust store of the OBTU : 
/opt/obtu/jre/lin64/bin/keytool -importcert -file cacert.cer -keystore /opt/obtu/jre/lin64/lib/security/cacerts

If you are using OBTU on a Windows machine, the follow the steps below :

"OBTU_EXTRACTED_LOCATION\jre\win32\bin\keytool.exe" -importcert -alias ALIAS -file "PATH_TO_CERT_FILE.cer" -keystore "OBTU_EXTRACTED_LOCATION\jre\win32\lib\security\cacerts"