bazel ssl errors behind corporate firewall

[tclarke]

> cd examples/cpp-tutorial/stage1
> bazel build //main:hello-world
WARNING: Download from https://github.com/bazelbuild/rules_cc/releases/download/0.0.2/rules_cc-0.0.2.tar.gz failed: class javax.net.ssl.SSLHandshakeException PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

> keytool -printcert -sslserver github.com | grep "Serial number"
Serial number: 47cd59e4c55f6c2645eca0a9b084fb1c
Serial number: 48000dc04f081ddcfb402f5c9f0001000dc04f
Serial number: 613116b6000100000009
Serial number: 189b8df8b302a78f41e7736825149863
# first one is github.com cert
> for x in 1 2 3; do keytool -printcert -file $x.crt | grep "Serial number"; done
Serial number: 48000a7885e385761ae93d33090001000a7885
Serial number: 613116b6000100000009
Serial number: 189b8df8b302a78f41e7736825149863
# all 3 match and are the CAs and decrypt keys for the corporate SSL intercept firewall
> for x in 1 2 3; do keytool -importcert -file $x.crt -keystore keystore -keypass changeit -trustcacerts -noprompt -alias $x-corp; done
.
.
.
> bazel --host_jvm_args=-Djavax.net.ssl.trustStore=keystore --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit build //main:hello-world

I get the same SSL errors.

jre1.8.0 (for keytool)
bazel 6.3.1

[tclarke]

UPDATE: I built bazel 6.3.1 from bootstrap and that worked. So the problem may be related to the bundled jvm not working with an external truststore? Still looking for options as I would like to be able to use the pre-build binaries if possible.