Can't get any imagery tiles from wmts provider in Windows 11

[Max1234-ITA]

I have a Windows 11 laptop; if I try to get imagery from a wmts provider (Italy - Lombardia (CTR-DBT) ), an error is displayed and no tile is downloaded.

I also have a Windows 10 desktop PC, and there the tile download seems to take place as expected.

What steps will reproduce the problem?

1. In Windows 11, launch JOSM
2. Go to 'Imagery preferences' menu and add the "Lombardia - Italy (CTR-DBT)" one.
3. Go to the Slippy Map and download some data belonging to any location in Italy, Lombardy region (i.e. a street in Milano)
4. Try to activate the Lombardia - Italy (CTR-DBT) layer

What is the expected result?

The desired layer is loaded and displayed

What happens instead?

A popup message is shown, reading "Could not retrieve WMS layer list".

Here's the debug log from stdout:

2024-04-10 17:42:06.846 WARNING: COMPAT locale provider will be removed in a future release
2024-04-10 17:42:06.949 INFO: Log level is at INFO (INFO, 800)
2024-04-10 17:42:07.244 WARNING: extended font config - overriding 'filename.Malgun_Gothic=malgun.ttf' with 'MALGUN.TTF'
2024-04-10 17:42:07.245 WARNING: extended font config - overriding 'filename.Myanmar_Text=mmrtext.ttf' with 'MMRTEXT.TTF'
2024-04-10 17:42:07.246 WARNING: extended font config - overriding 'filename.Mongolian_Baiti=monbaiti.ttf' with 'MONBAITI.TTF'
2024-04-10 17:42:07.853 SEVERE: java.security.KeyStoreException: Windows-ROOT not found. Cause: java.security.NoSuchAlgorithmException: Windows-ROOT KeyStore not available
java.security.KeyStoreException: Windows-ROOT not found
        at java.base/java.security.KeyStore.getInstance(Unknown Source)
        at org.openstreetmap.josm.tools.PlatformHookWindows.getRootKeystore(PlatformHookWindows.java:339)
        at org.openstreetmap.josm.tools.PlatformHookWindows.getX509Certificate(PlatformHookWindows.java:349)
        at org.openstreetmap.josm.io.CertificateAmendment.addMissingCertificates(CertificateAmendment.java:226)
        at org.openstreetmap.josm.gui.MainApplication.mainJOSM(MainApplication.java:946)
        at org.openstreetmap.josm.gui.MainApplication$3.processArguments(MainApplication.java:285)
        at org.openstreetmap.josm.gui.MainApplication.main(MainApplication.java:788)
Caused by: java.security.NoSuchAlgorithmException: Windows-ROOT KeyStore not available
        at java.base/sun.security.jca.GetInstance.getInstance(Unknown Source)
        at java.base/java.security.Security.getImpl(Unknown Source)
        ... 7 more

2024-04-10 17:42:10.822 INFO: Obtained 157 Tag2Link rules from resource://META-INF/resources/webjars/tag2link/2024.2.8/index.json
2024-04-10 17:42:14.047 INFO: Could not load tool definition splitway
2024-04-10 17:42:14.222 INFO: Changeset updater active (checks every 60 minutes if open changesets have been closed)
2024-04-10 17:42:18.316 INFO: GET https://josm.openstreetmap.de/mapkey/Mapbox -> HTTP/1.1 200 (49 ms; 98 B)
2024-04-10 17:42:20.352 INFO: GET https://api.openstreetmap.org/api/0.6/map?bbox=9.2216567,45.4355709,9.2287736,45.4387125 -> HTTP/1.1 200 (231 ms)
2024-04-10 17:42:30.598 INFO: GET https://www.cartografia.servizirl.it/arcgis2/rest/services/BaseMap/dbtr_toni_grigio/MapServer/WMTS?request=GetCapabilities&service=WMTS&version=1.0.0 -> !!! (183 ms)
2024-04-10 17:42:30.599 WARNING: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(Unknown Source)
        at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at org.openstreetmap.josm.tools.Http1Client.performConnection(Http1Client.java:78)
        at org.openstreetmap.josm.tools.HttpClient.connect(HttpClient.java:162)
        at org.openstreetmap.josm.tools.HttpClient.connect(HttpClient.java:136)
        at org.openstreetmap.josm.tools.HttpClient.connect(HttpClient.java:125)
        at org.openstreetmap.josm.io.CachedFile.checkLocal(CachedFile.java:498)
        at org.openstreetmap.josm.io.CachedFile.getFile(CachedFile.java:284)
        at org.openstreetmap.josm.io.CachedFile.getInputStream(CachedFile.java:227)
        at org.openstreetmap.josm.data.imagery.WMTSTileSource.getCapabilities(WMTSTileSource.java:455)
        at org.openstreetmap.josm.data.imagery.WMTSTileSource.<init>(WMTSTileSource.java:366)
        at org.openstreetmap.josm.actions.AddImageryLayerAction.convertImagery(AddImageryLayerAction.java:128)
        at org.openstreetmap.josm.actions.AddImageryLayerAction.actionPerformed(AddImageryLayerAction.java:167)
        at java.desktop/javax.swing.AbstractButton.fireActionPerformed(Unknown Source)
        at java.desktop/javax.swing.AbstractButton$Handler.actionPerformed(Unknown Source)
        at java.desktop/javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source)
        at java.desktop/javax.swing.DefaultButtonModel.setPressed(Unknown Source)
        at java.desktop/javax.swing.AbstractButton.doClick(Unknown Source)
        at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI.doClick(Unknown Source)
        at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(Unknown Source)
        at java.desktop/java.awt.AWTEventMulticaster.mouseReleased(Unknown Source)
        at java.desktop/java.awt.Component.processMouseEvent(Unknown Source)
        at java.desktop/javax.swing.JComponent.processMouseEvent(Unknown Source)
        at java.desktop/java.awt.Component.processEvent(Unknown Source)
        at java.desktop/java.awt.Container.processEvent(Unknown Source)
        at java.desktop/java.awt.Component.dispatchEventImpl(Unknown Source)
        at java.desktop/java.awt.Container.dispatchEventImpl(Unknown Source)
        at java.desktop/java.awt.Component.dispatchEvent(Unknown Source)
        at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source)
        at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Unknown Source)
        at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Unknown Source)
        at java.desktop/java.awt.Container.dispatchEventImpl(Unknown Source)
        at java.desktop/java.awt.Window.dispatchEventImpl(Unknown Source)
        at java.desktop/java.awt.Component.dispatchEvent(Unknown Source)
        at java.desktop/java.awt.EventQueue.dispatchEventImpl(Unknown Source)
        at java.desktop/java.awt.EventQueue$4.run(Unknown Source)
        at java.desktop/java.awt.EventQueue$4.run(Unknown Source)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source)
        at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source)
        at java.desktop/java.awt.EventQueue$5.run(Unknown Source)
        at java.desktop/java.awt.EventQueue$5.run(Unknown Source)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(Unknown Source)
        at java.desktop/java.awt.EventQueue.dispatchEvent(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.pumpEvents(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.pumpEvents(Unknown Source)
        at java.desktop/java.awt.EventDispatchThread.run(Unknown Source)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source)
        at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
        at java.base/sun.security.validator.Validator.validate(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
        ... 64 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
        at java.base/java.security.cert.CertPathBuilder.build(Unknown Source)
        ... 69 more

2024-04-10 17:42:34.801 SEVERE: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Please provide any additional information below. Attach a screenshot if possible.

Revision:18969
Build-Date:2024-02-06 12:12:39

Identification: JOSM/1.5 (18969 en) Windows 11 64-Bit
OS Build number: Windows 10 Pro 2009 (22621)
Memory Usage: 244 MB / 3970 MB (145 MB allocated, but free)
Java version: 17.0.10+7-LTS, Azul Systems, Inc., OpenJDK 64-Bit Server VM
Look and Feel: com.sun.java.swing.plaf.windows.WindowsLookAndFeel
Screen: \Display0 1920×1080 (scaling 1.00×1.00) \Display1 1920×1080 (scaling 1.00×1.00)
Maximum Screen Size: 1920×1080
Best cursor sizes: 16×16→32×32, 32×32→32×32
System property file.encoding: Cp1252
System property sun.jnu.encoding: Cp1252
Locale info: en_US
Numbers with default locale: 1234567890 -> 1234567890
VM arguments: [-Djpackage.app-version=1.5.18969, --add-modules=java.scripting,java.sql,javafx.controls,javafx.media,javafx.swing,javafx.web, --add-exports=java.base/sun.security.action=ALL-UNNAMED, --add-exports=java.desktop/com.sun.imageio.plugins.jpeg=ALL-UNNAMED, --add-exports=java.desktop/com.sun.imageio.spi=ALL-UNNAMED, --add-opens=java.base/java.lang=ALL-UNNAMED, --add-opens=java.base/java.nio=ALL-UNNAMED, --add-opens=java.base/jdk.internal.loader=ALL-UNNAMED, --add-opens=java.base/jdk.internal.ref=ALL-UNNAMED, --add-opens=java.desktop/javax.imageio.spi=ALL-UNNAMED, --add-opens=java.desktop/javax.swing.text.html=ALL-UNNAMED, --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED, -Djpackage.app-path=%UserProfile%\AppData\Local\JOSM\HWConsole.exe]

Map paint styles:
+ https://josm.openstreetmap.de/josmfile?page=Styles/Potlatch2&zip=1

Last errors/warnings:
- 00000.347 W: extended font config - overriding 'filename.Myanmar_Text=mmrtext.ttf' with 'MMRTEXT.TTF'
- 00000.349 W: extended font config - overriding 'filename.Mongolian_Baiti=monbaiti.ttf' with 'MONBAITI.TTF'
- 00000.817 E: java.security.KeyStoreException: Windows-ROOT not found. Cause: java.security.NoSuchAlgorithmException: Windows-ROOT KeyStore not available
- 00019.172 W: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- 00022.036 E: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[Max1234-ITA]

Popup appearing after trying to download wmts tiles

[skyper]

Works for me on Linux.
The debug log looks like there is a problem with ssl. The server's ssl certificate seems to be missing on your system (or it is place under an uncommon path.

As a temporally solution you can try to use the imagery without ssl encryption by manually adding the imagery to your favorites in the Imagery Preferences and then manually edit the server's URL changing https to http.

[skyper]

See also #22101.

[Max1234-ITA]

I "solved" by migrating to Java OpenWebStart: after the installation I tried adding that layer again and got a request for trusting that particular domain. I trusted it "Forever" but it just lasted for 3 days, then the same symptoms arose again.

As a workaround, I opened the provider site (​https://www.cartografia.servizirl.it) in Chrome, exported the website certificate, as explained in many tutorials, i.e. ​https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2; After that I opened the Java control panel and manually imported the saved certificate.

Now it seems to work, hope it will not expire soon; anyway, being able to accomplish such a task directly from JOSM (at least for imagery layers) would be very helpful.

Cheers,
Max