Resolve untrusted middle SSL server connection for Java environment (especially bazelbuild)

resolve-java-cacerts.sh

# get latest OpenJDK (10 at here)
# from: http://jdk.java.net/10/
#
# Example (OpenJDK 10-10.0.2 / GA)
# https://download.java.net/java/GA/jdk10/10.0.2/19aef61b38124481863b1413dce1855f/13/openjdk-10.0.2_linux-x64_bin.tar.gz

# 0. Extract openjdk into shared directory
# sudo if needed
tar -xf <openjdk>.tar.gz -C /usr/local

# 1. set JAVA_HOME 
# for system-wide, append at /etc/profile <sudo required>
# for user-wide, append at ~/.bashrc
# Example (openJDK 10.0.2)
#export JAVA_HOME=/usr/local/jdk-10.0.2
export JAVA_HOME=<installed JDK location>
# also export PATH if you needed
export PATH=$JAVA_HOME/bin:$PATH

# 2. install custom root ca in custom jdk cacerts, sudo if needed
# above JDK 9
keytool -importcert -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \
 -storepass changeit -alias Root -file <customca.crt>

keytool -import -trustcacerts -keystore $JAVA_HOME/lib/security/cacerts \
 -storepass changeit -alias Root -import -file <customca.crt>
 
# under JDK 8
keytool -import -trustcacerts -keystore /opt/jdk1.8.0_202/jre/lib/security/cacerts \
 -storepass changeit -alias Root -file <customca.crt>

# 3. install custom root ca in system reference (for CentOS 7), sudo if you needed
cp <customca.crt> /etc/pki/ca-trust/source/anchors/
update-ca-trust

# Use case for bazelbuild
bazel --server_javabase=$JAVA_HOME build --config=opt //tensorflow/tools/pip_package:build_pip_package

# References:
# http://jdk.java.net
# https://knowledge.digicert.com/solution/SO4085.html
# https://stackoverflow.com/questions/37043442/how-to-add-certificate-authority-in-centos7