# SSLHandshakeException: PKIX building failed
**URL:** https://community.jenkins.io/t/sslhandshakeexception-pkix-building-failed/32291
**Category:** Using Jenkins
**Created:** [June 3, 2025, 6:26pm UTC](https://community.jenkins.io/t/sslhandshakeexception-pkix-building-failed/32291 "2025-06-03T18:26:55Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@vortex388](https://community.jenkins.io/u/vortex388)
#### Post date: [June 3, 2025, 6:26pm UTC](https://community.jenkins.io/t/sslhandshakeexception-pkix-building-failed/32291/1 "2025-06-03T18:26:55Z")
I cannot update the plugins or the version of Jenkins due to some sort of handshaking error. We’ve already updated to JDK-21, followed the Windows direction to add the entire certificate chain for [https://archives.jenkins.io](https://archives.jenkins.io) and [https://updates.jenkins.io](https://updates.jenkins.io), and attempted to change to http in the URL but nothing seems to remedy the issue.
> **Jenkins setup:**
>
> ```
> Jenkins: 2.492.3
> OS: Windows Server 2019 - 10.0
> Java: 21.0.7 - Oracle Corporation (Java HotSpot(TM) 64-Bit Server VM)
> ---
> active-directory:2.39
> analysis-model-api:13.2.0
> ant:513.vde9e7b_a_0da_0f
> antisamy-markup-formatter:173.v680e3a_b_69ff3
> apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
> apache-httpcomponents-client-5-api:5.4.3-140.v2516ccde99e7
> asm-api:9.8-135.vb_2239d08ee90
> authentication-tokens:1.131.v7199556c3004
> bootstrap5-api:5.3.3-2
> bouncycastle-api:2.30.1.80-256.vf98926042a_9b_
> branch-api:2.1214.v3f652804588d
> build-timeout:1.37
> build-token-root:151.va_e52fe3215fc
> caffeine-api:3.2.0-166.v72a_6d74b_870f
> checks-api:367.v18b_7f530e54a_
> cloudbees-folder:6.999.v42253c105443
> command-launcher:118.v72741845c17a_
> commons-lang3-api:3.17.0-87.v5cf526e63b_8b_
> commons-text-api:1.13.0-153.v91dcd89e2a_22
> config-file-provider:982.vb_a_e458a_37021
> configuration-as-code:1947.v7d33fe23569c
> copyartifact:765.v0357cc6e6eb_3
> credentials:1413.va_51c53703df1
> credentials-binding:687.v619cb_15e923f
> dark-theme:524.vd675b_22b_30cb_
> data-tables-api:2.2.2-1
> display-url-api:2.209.v582ed814ff2f
> docker-commons:451.vd12c371eeeb_3
> durable-task:587.v84b_877235b_45
> echarts-api:5.6.0-2
> eddsa-api:0.3.0.1-19.vc432d923e5ee
> email-ext:1876.v28d8d38315b_d
> envinject-api:1.235.va_14c74f8f487
> external-monitor-job:223.vb_fddcf42c9b_3
> file-operations:353.vf3b_9b_a_f1f7f7
> flatpickr-api:4.6.13-18.vcf5f6a_5b_8468
> font-awesome-api:6.7.2-1
> fortify:23.1.40
> gradle:2.14.1
> gson-api:2.12.1-113.v347686d6729f
> htmlpublisher:425
> instance-identity:203.v15e81a_1b_7a_38
> ionicons-api:82.v0597178874e1
> jackson2-api:2.18.3-402.v74c4eb_f122b_2
> jakarta-activation-api:2.1.3-2
> jakarta-mail-api:2.1.3-2
> javax-activation-api:1.2.0-8
> javax-mail-api:1.6.2-11
> jaxb:2.3.9-133.vb_ec76a_73f706
> jdk-tool:83.v417146707a_3d
> jjwt-api:0.11.5-120.v0268cf544b_89
> jnr-posix-api:3.1.20-138.vdb_9db_a_39182f
> joda-time-api:2.14.0-127.v7d9da_295a_d51
> jquery3-api:3.7.1-3
> jsch:0.2.16-95.v3eecb_55fa_b_78
> json-api:20250107-125.v28b_a_ffa_eb_f01
> json-path-api:2.9.0-148.v22a_7ffe323ce
> jsoup:1.19.1-38.v216a_f3721b_3c
> junit:1319.v000471ca_e5e2
> ldap:780.vcb_33c9a_e4332
> lighthouse-report:1.3.0
> lockable-resources:1349.v8b_ccb_c5487f7
> login-theme:262.vb_4ce39d5279f
> mailer:489.vd4b_25144138f
> mapdb-api:1.0.9-44.va_1e1310c9118
> matrix-auth:3.2.6
> matrix-project:847.v88a_f90ff9f20
> mina-sshd-api-common:2.15.0-161.vb_200831a_c15b_
> mina-sshd-api-core:2.15.0-161.vb_200831a_c15b_
> nodejs:1.6.4
> okhttp-api:4.11.0-189.v976fa_d3379d6
> outbound-webhook:0.3.0
> pam-auth:1.12
> pipeline-build-step:557.v95d96f77b_2b_8
> pipeline-graph-analysis:235.vb_a_a_36b_f248c2
> pipeline-groovy-lib:752.vdddedf804e72
> pipeline-input-step:517.vf8e782ee645c
> pipeline-milestone-step:127.vb_52887ca_3b_6d
> pipeline-model-api:2.2247.va_423189a_7dff
> pipeline-model-definition:2.2247.va_423189a_7dff
> pipeline-model-extensions:2.2247.va_423189a_7dff
> pipeline-rest-api:2.37
> pipeline-stage-step:322.vecffa_99f371c
> pipeline-stage-tags-metadata:2.2247.va_423189a_7dff
> pipeline-stage-view:2.37
> plain-credentials:195.vb_906e9073dee
> plugin-util-api:6.1.0
> powershell:2.3
> prism-api:1.30.0-1
> publish-over:0.22
> publish-over-cifs:0.16
> purge-job-history:74.vf21030329dda_
> resource-disposer:0.25
> saferestart:102.v4dc1b_9636a_ee
> schedule-build:649.vd4058b_a_a_cf54
> scm-api:704.v3ce5c542825a_
> script-security:1373.vb_b_4a_a_c26fa_00
> simple-theme-plugin:211.v5424a_5510e47
> snakeyaml-api:2.3-125.v4d77857a_b_402
> ssh-credentials:355.v9b_e5b_cde5003
> ssh-slaves:3.1031.v72c6b_883b_869
> sshd:3.353.v2b_d33c46e970
> structs:343.vdcf37b_a_c81d5
> subversion:1287.vd2d507146906
> theme-manager:278.v2e3c063e42cc
> thinBackup:2.1.2
> timestamper:1.28
> token-macro:444.v52de7e9c573d
> trilead-api:2.192.vc50a_d147e369
> variant:70.va_d9f17f859e0
> workflow-aggregator:608.v67378e9d3db_1
> workflow-api:1366.vf1fb_e1a_f6b_22
> workflow-basic-steps:1079.vce64b_a_929c5a_
> workflow-cps:4080.va_15b_44a_91525
> workflow-durable-task-step:1405.v1fcd4a_d00096
> workflow-job:1508.v9cb_c3a_a_89dfd
> workflow-multibranch:803.v08103b_87c280
> workflow-scm-step:437.v05a_f66b_e5ef8
> workflow-step-api:700.v6e45cb_a_5a_a_21
> workflow-support:963.va_600813d04a_a_
> ws-cleanup:0.48
> ```
---
### Author:  [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)
#### Post date: [June 3, 2025, 10:18pm UTC](https://community.jenkins.io/t/sslhandshakeexception-pkix-building-failed/32291/2 "2025-06-03T22:18:48Z")
> [@vortex388](#):
>
> followed the Windows direction to add the entire certificate chain for [https://archives.jenkins.io](https://archives.jenkins.io) and [https://updates.jenkins.io](https://updates.jenkins.io)
That should not be necessary. Java installations on Windows, Linux, and macOS already include the necessary certificates. If you are required to install additional certificates, it may indicate that network devices between you and [updates.jenkins.io](http://updates.jenkins.io) are interfering with the data transfer.
---
### Author:  [@vortex388](https://community.jenkins.io/u/vortex388)
#### Post date: [June 6, 2025, 6:05pm UTC](https://community.jenkins.io/t/sslhandshakeexception-pkix-building-failed/32291/4 "2025-06-06T18:05:24Z")
We were able to get it resolved. It was indeed a Java CA issue. Our servers access the internet via a reverse proxy and the certificate chain gets swapped out with our internal CA certs and the certs were not in the java cert store. There must have been a certificate update on the enterprise side recently, so the certificate chain was no longer trusted. We downloaded each of the three new CA’s in PEM format and then inserted them into the JKD cert store.