download tests fail in Scala 2.12 community build on OpenJDK 10

[SethTisue]

I'm not sure if this is two problems or one problem, but at e.g. https://scala-ci.typesafe.com/view/scala-2.12.x/job/scala-2.12.x-jdk10-integrate-community-build/56/consoleFull and in other runs we consistently see:

[gigahorse] [info] - should retrieve a resource from Wikipedia *** FAILED ***
[gigahorse] [info]   java.net.ConnectException: General SSLEngine problem
...
[gigahorse] [info]   Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

and then a bit later the whole thing hangs until Jenkins times out:

[gigahorse] [info] http.download
Build timed out (after 15 minutes). Marking the build as aborted.

[xuwei-k]

reproduce in travis-ci

• xuwei-k@d63ea19
• https://travis-ci.org/xuwei-k/gigahorse/jobs/402927553#L779

workaround in travis-ci

• xuwei-k@7a6461f
• Add Java Oracle JDK 10 travis-ci/travis-ci#9368 (comment)

[xuwei-k]

succeeded with oraclejdk10

• https://travis-ci.org/xuwei-k/gigahorse/builds/402931514
• xuwei-k@b06c56f

[eed3si9n]

Potentially related:

• Error - trustAnchors parameter must be non-empty - https://stackoverflow.com/a/50103533/3827
• 9-jdk image has SSL issues 9-jdk image has SSL issues docker-library/openjdk#145
• JEP 229: Create PKCS12 Keystores by Default - http://openjdk.java.net/jeps/229
• Ubuntu 1770553: [SRU] backport ca-certificates-java from cosmic (20180413ubuntu1) - https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1770553

So the cert store can be in JKS format, PKCS12 format with empty password, or PKCS12 format with the password set to changeit?

[SethTisue]

scala/community-build#840

[SethTisue]

(not sure whether this got fixed because we're on JDK 11 now, or what)