Java Maven project in VSCode: unable to find valid certification path to requested target

Full disclaimer: I'm not a Java expert.

My work group developed a Java project, managed by maven, which should be compiled against jdk-11. They all use IntelliJ and I was able to set it up on this platform. I'm now trying to do the same setup on VSCode, because I'm more familiar with it.

I installed openjdk-11, added the relevant cacerts in /Library/Java/JavaVirtualMachines/adoptopenjdk-11.jdk/Contents/Home/lib/security, pointed VSCode to this version and to the same maven executable used by IntelliJ for compiling.

I can correctly compile the project by doing mvn clean install and run part of the application in the Run/Debug window (only had to manually add all the classPaths in launch.json). However the "Language Support for Java" tab in the Output window still shows me this error

Cannot download published Gradle versions.
org.gradle.api.UncheckedIOException: Cannot download published Gradle versions.
....
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
[Error - 10:18:41] 27 Feb 2023, 10:18:41 Error occured while building workspace. Details: 
 message: The project cannot be built until build path errors are resolved;

It seems that the "Language Support for Java" is using a different jdk with no cacerts installed, but somehow I cannot figure out where this version is located. I tried to specify the right java_home wherever I could in VSCode (also in Gradle) but somehow I cannot get rid of this error.
I don't know if this is really a problem or not, as the project is compiling when I launch maven, but it would be good to fix it. To me it is not really clear at the moment how many different "layers" are used when opening a java project like this in VSCode.

Trying to resolve this problem for my environment, I found your comment
> It seems that the "Language Support for Java" (VSCode plugin) is using a different jdk ...

was the key to discovering a fix in my case.
This link explains that the extension does use an embedded JRE and also provides a resolution to the problem.

The embedded JRE is located at (depending on extension version and operating system):

.vscode/extensions/redhat.java-1.15.0-linux-x64/jre

which is usually located directly under $HOME on Linux and MacOS or %USERPROFILE% on Windows. The embedded JRE has a cacerts file, for example:

.vscode/extensions/redhat.java-1.15.0-linux-x64/jre/17.0.6-linux-x86_64/lib/security/cacerts

To resolve the problem you can either:

1. add the required certificates to the embedded JRE cacerts file, however, you will need to repeat this every time the extension is updated, or
2. configure the embedded JRE to use another certificate store file that contains the required certificates by modifying the VSCode user settings (settings.xml file) "java.jdt.ls.vmargs" entry to append the properties:

   "-Djavax.net.ssl.trustStore=path/to/other/cacerts -Djavax.net.ssl.trustStorePassword=changeit"
   

   substituting the correct certificate store path and password.

In the case of option 2 you can simply use the path to the Open JDK 11 cacerts file that you have already modified.

Starting with Maven 3.9 they changed the default Transport implementation to native.

Try with this option to disable SSL verifications:

mvn compile -Daether.connector.https.securityMode=insecure

Background:
https://maven.apache.org/resolver/configuration.html