PKIX path building failed with custom truststore in Gradle Daemon

The Gradle Daemon does not refresh the truststore on every build

The Gradle Daemon is a long-lived JVM process. Because the SSL context and truststore are initialized during the JVM startup sequence, the daemon retains the certificate chain in memory. If you update the truststore file on disk or modify gradle.properties while a daemon is already running, those changes will not be reflected in subsequent build executions.

Likely Cause of Failure

The PKIX path building failed error occurs because the running JVM process is attempting to validate the server's certificate against a stale version of the truststore loaded at startup. Since the JVM does not poll the truststore file for changes, the updated self-signed certificate is ignored until the process is recycled.

Resolution Steps

There are no command-line flags or API calls to force a reload of the SSL context within a running JVM. To apply truststore updates, you must terminate the existing daemon process:

1. Stop all running daemons:

   ./gradlew --stop

2. Verify the truststore path: Ensure gradle.internal.http.trustStore in gradle.properties points to the absolute path of the updated JKS or PKCS12 file.
3. Restart the build: Run your build command again. Gradle will spawn a new daemon process, which will load the updated truststore during its initialization phase.

Verification

To confirm the daemon is using the correct configuration, you can check the JVM arguments of the active process using the Java Process Status tool:

jps -v

Look for the -Djavax.net.ssl.trustStore property (or the internal Gradle equivalent) in the output to ensure the path is correct.

Diagnostic Requirement

If the error persists after a --stop, please specify if you are using a Gradle Wrapper or a global Gradle installation, as this affects where the JVM arguments are sourced.