Could not read from VoiceRSS service after upgrade to 4.3.5

Add-ons Text-to-Speech
1

I recently upgraded from 4.2.x to 4.3.5 and my VoiceRSS TTS is failing with “Could not read from VoiceRSS service: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target”.

I bumped up the log level and can see that it makes a call to the VoiceRSS API just before this error:

2025-06-29 17:05:18.397 [DEBUG] [.internal.cloudapi.VoiceRSSCloudImpl] - Call https://api.voicerss.org/?key=***&hl=en-AU&c=WAV&f=16khz_16bit_mono&src=Hello&v=Evie
2025-06-29 17:05:19.091 [WARN ] [core.voice.internal.VoiceManagerImpl] - Error saying 'Hello ': Could not read from VoiceRSS service: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I can run that call fine in my browser (with my key).

Any ideas?

1 Like
2

same problem here… i didn’t notice that was after the upgrade…
I will try to rollback!

3

As mentioned here, it works for me in OH 5.

4

I’m experiencing the same issue with openHAB version 4.3.5.

Here is my error message:

2025-07-01 22:31:42.690 [WARN ] [.openhab.core.voice.internal.VoiceManagerImpl] - Error saying 'Test!': Could not read from VoiceRSS service: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

It used to work fine before.
I already cleared the cache – didn’t help.

5

Maybe they use a new certificate that is signed with an untrusted certificate? In that case updating your OS or Java may help so it updates the list of trusted certificates.

6

SSL certificate is fine:

image

7

An outdated OS/Java on a computer may still not trust the certificates. It won’t use that website to check the validity. :wink:

8

I spent a couple of hours this afternoon looking into this and have now resolved it.

For anyone interested, I’m running Raspberry Pi OS (Linux) and the first thing I tried was patching and a reboot. I was already running the latest OpenJDK17 package.

I think tried installing and using the latest Azul Zulu Build of OpenJDK 17, which also had the same problem so I went back to OpenJDK.

I then noticed that the Sectigo root certificate of api.voicerss.org’s SSL certificate wasn’t in /etc/ssl/certs/java/cacerts so I imported it from the OS’s copy in /etc/ssl/certs - problem solved.

Hope this helps anyone else who may run into this.

2 Likes
9

It has been working perfectly for me again since yesterday without any changes to my openHab system

1 Like
10

I added two certificates (Sectigo R46 and Sectigo E46) and restarted the VoiceRSS bundle but I have the same error. Any suggestion?

12

Restart OpenHAB

13

same issue on docker with 4.3.5; restart does not solve. voicerss profile is active, I even generated a new api key. I also deleted tmp and cache and tried again with same result:

Error saying 'Test': Could not read from VoiceRSS service: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
14

I’m experiancing the same, was on 4.3.5 now upgrade to 5 and still same problem

15

Ahh, you’re using docker. The container image will have to be updated with the certs. As a container I assume you have to restart the container to restart openhab. In that case any changed you made in the container file system would be lost.

16

Yes, openhab restart means container restart. If mount is not mapped, data are not persistet if new built but survive restart. Anyhow, I have not downloaded certificates manually: I do neither now how nor does this feel the right way as I have not downloaded the old certificates as well. Maybe binding needs to be updated?

17

Are all of you having still a problem with VoiceRSS running OH in docker ?

18

My OH5 is not in docker and i’m having the problem.

Does someone have instructions how to import those certs from the OS copy into Java?

19

Here’s what I did that fixed the issue for me. I’m running openjdk version “21.0.8” on Ubuntu 22.04 LTS

sudo keytool -import -trustcacerts -alias Sectigo_E46 -file /usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt -keystore /etc/ssl/certs/java/cacerts

sudo keytool -import -trustcacerts -alias Sectigo_R46 -file /usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt -keystore /etc/ssl/certs/java/cacerts

Restart openHAB
1 Like
20

Pardon my ignorance. I’ve the same problem and wanted to import the certificates with the command you shared. However, I don’t have those certificates in /usr/share/ca-certificates/mozilla/ and in the rest of my install (openhabian 2025-08-01T10:06:08-06:00). Do I need to download them from somewhere? Using openjdk version “17.0.15” 2025-04-15 and OpenHAB 4.3.5.

Thanks!

21

Let me see if I can figure out which package dropped those files there.