SSL exception using arXiv importer

[tsmithe]

JabRef 5.0.0-dev--2019-12-02----9d620f18d (installed using the nightly deb file)
Linux 5.3.0-2-amd64 amd64 (Debian testing)
Java 13.0.1

• I have tested the latest development version from http://builds.jabref.org/master/ and the problem persists

I have observed this bug across JabRef and JRE versions, with JREs provided by both Oracle and Bell Soft. I am reporting the bug as observed with JabRef master.

To reproduce, all I need to do is to try to import an arXiv article using usual the `web search' feature. Oddly, the feature was working fine this morning, and I thought that, having upgraded to JabRef 5 (from 4.3), I had resolved the issue I had been having. But now it has reappeared, and seems to be the same as on 4.3. Importing via (eg) DOI seems to work fine, and when I ran JabRef 4.3 with SSL debugging turned on, I saw SSL errors seemingly relating to the export.arxiv.org certificate.

Log File

org.jabref.logic.importer.FetcherException: arXiv API request failed
  at org.jabref/org.jabref.logic.importer.fetcher.ArXiv.callApi(Unknown Source)
  at org.jabref/org.jabref.logic.importer.fetcher.ArXiv.queryApi(Unknown Source)
  at org.jabref/org.jabref.logic.importer.fetcher.ArXiv.searchForEntries(Unknown Source)
  at org.jabref/org.jabref.logic.importer.fetcher.ArXiv.performSearch(Unknown Source)
  at org.jabref/org.jabref.gui.importer.fetcher.WebSearchPaneViewModel.lambda$search$1(Unknown Source)
  at org.jabref/org.jabref.gui.util.BackgroundTask$1.call(Unknown Source)
  at org.jabref/org.jabref.gui.util.DefaultTaskExecutor$1.call(Unknown Source)
  at org.jabref.merged.module/javafx.concurrent.Task$TaskCallable.call(Unknown Source)
  at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
  at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
  at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.base/java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
  at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
  at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
  at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
  at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
  at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
  at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
  at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
  at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
  at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
  at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
  at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
  at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
  at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
  at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
  at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
  at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
  at java.base/java.net.HttpURLConnection.getResponseCode(Unknown Source)
  at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
  ... 14 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source)
  at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
  at java.base/sun.security.validator.Validator.validate(Unknown Source)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
  ... 31 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
  at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
  at java.base/java.security.cert.CertPathBuilder.build(Unknown Source)
  ... 36 more

[Siedlerchr]

Hi,
thanks for your report. I recently encountered this as well and it seems it's a temporary problem of the arxiv site. I just tried again with the current master and it's fine for me at the moment.

So I would say try again later.

[tsmithe]

Yes, odd, it just worked again for me. But it also seemed much more prevalent with JabRef 4.3, but perhaps that was illusory. And why don't I get an SSL error if I browse to https://export.arxiv.org in Firefox?..

[Siedlerchr]

Hm. I really believe it was a "hickup" or a short outage. Browsing the site in Firefox it's fine again.+
Edit// SSL Error: Might be that the java client downloads and validates the certificate

[tsmithe]

Occurring again just now ...

Edit: 11 minutes later, seems to be working again ... Very mysterious.

[stefan-kolb]

Cannot reproduce this unfortunately. I'd close this for now. Feel free to provide us with more information if possible if this issue still occurs often for you!