Sometimes I need to install a cacert into my jdk so that gradle can pull down dependencies for my project. If I try to sync gradle, and it fails... and then i install the cacert... i can't sync gradle again and get a success. instead... I need to delete the global

.gradle

folder on my mac. then sync again. and everything works. Anyone know why that is? deleting

.gradle

is a heavy operation and id love to only delete a specific file or something inside of

.gradle

if anyone knows the true culprit.

surely something like https://gradle-community.slack.com/archives/CAHSN3LDN/p1723196089290129?thread_ts=1723190399.276349&cid=CAHSN3LDN would be easier than modifying your JDKs?

Also, if you/your IT department installed the caceet into your system store, it is way easier to just use the system store. (Looking at you, zScaler…)

Instead of deleting your whole Gradle User Home, is it not sufficient to use

--refresh-dependencies

or to use the according IDE button?

my old post is hidden on slack desktop but visible on slack mobile, good job slack

Always better to use a linen.dev link as those do not expire 🙂 https://www.linen.dev/s/gradle-community/t/22897218/gradle-jdk-toolchain-what-is-the-resolving-algorithm#7dd0ce5f-a425-47fe-b195-f8aec762782e

Instead of deleting your whole Gradle User Home, is it not sufficient to use

--refresh-dependencies

or to use the according IDE button?

correct. ive tried those two things. no dice.

you can read the script. it makes a local copy of the keystore with an added key, then tells the current JVM to use it instead. you could of course do it in a variety of other ways, but there's never a need to modify the JDK itself.

gotcha. it seems like after macOS updates the jdk loses the installed cert. which is why im running into this issue now.

For Gradle: # local zScaler proxy host and port systemProp.https.proxyHost=127.0.0.1 systemProp.https.proxyPort=9000 # to support zScaler TLS inspection, use the Windows cert storage with the zScaler cert systemProp.javax.net.ssl.trustStoreType=Windows-ROOT # macOS systemProp.javax.net.ssl.trustStoreType=KeychainStore

@Philip W since im on mac os... i would install the cert into my mac keystore. and then just add

<http://systemProp.javax.net|systemProp.javax.net>.ssl.trustStoreType=KeychainStore

to my gradle.properties? Am I understanding that correctly?

Des

cool. do i need to add those zscaler lines as well? im going to give this a try this weekend. would be awesome to not have to hit this issue every time macOS updates lol

my script goes in

~/.gradle/init.d/certs.init.gradle.kts

. there's no way to put it in the local build and have Gradle automatically apply it https://github.com/gradle/gradle/issues/17826

oh! it goes into global .gradle dir. even better!

There are no dumb questions, just dumb answers 🙂

Oh true. I forgot i could just set the props there. ❤️

BTW zScaler installs its own tls certificate automatically into the system keystore, so all you need are the three properties.

oooh interesting. okay. i'll add the three props. 🤞

JAVA_TOOL_OPTIONS=-Djavax.net.ssl.trustStoreType=KeychainStore gradle-profiler

?

interesting. id just set that as an env variable? edit: tried adding it as an env var and it failed when going that route.

Yes, that one-liner sets it as the variable for that call, but you can also set it as regular env variable. It's strange that it does not work. That env variable is read by the JVM itself upon start and can be used to give options to any JVM started, no matter how. Did it output that it found the variable and just had no effect or did it not even output that?

I ran

JAVA_TOOL_OPTIONS=-Djavax.net.ssl.trustStoreType=KeychainStore gradle-profiler --benchmark --scenario-file scenarios.txt

and i get the ssl issue when running but if I do

gradle-profiler --gradle-user-home ~/.gradle --benchmark --scenario-file scenarios.txt

then it works.

But did you get the

Picked up JAVA_TOOL_OPTIONS: -<http://Djavax.net|Djavax.net>.ssl.trustStoreType=KeychainStore

message? And especially not from the

gradle-profiler

JVM but from the Gradle daemon JVM where you need it.

"Picked up" I did not

Depends on whether you want it for each and every started JVM on the computer and don't mind the "picked up" line which you cannot disable, or only want it for Gradle.

got it. for now those are two insanely great solution. FWIW, installing the cert into a jdk still seems to be sometimes needed for zscalar. the example I have is that my SO works at a different company than me, but still has zscalar. i told them about this "trick", and it would not work. then i installaed the cert into the jdk and it worked. we spent 5 hours yesterday trying to get it to work with the JAVA_TOOL_OPTIONS technique and the gradle.properties technique but no luck. its almost like on their laptop the macOS keystore doesn't get picked up correctly. We tried installing the cert into mac keystore, and a bunch of chatgpt'ing, but nothing. darn. was hoping that my solution would work for them too.