javax.net.ssl.SSLException: Connection reset error with OpenJDK Alpine

Hi Everyone,

I am trying to create an OpenJDK Docker image with Alpine as a base image but I am facing javax.net.ssl.SSLException: Connection reset error.

Tried the following

adding ca-certificates, p11-kit-trust, java-cacerts to the Docker file generating the OpenJDK image
Added our internal certificates to /usr/local/share/ca-certificates/

3.Updating ca-certificate password with keystore

Alpine Version : 3.18 JDK Version : jdk8u412-b08 BINARY_URL='https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u412-b08/OpenJDK8U-jdk_x64_alpine-linux_hotspot_8u412b08.tar.gz'

But Still facing the same error. Request your help on this. Attaching our Docker file for your reference.

Dockerfile.txt

@NisharunnisaShaik I assume you're able to create the Docker image just find but when you run your application and it tries to make a connection you get that error?

Generic GPT4o advice follows:

Debugging SSL issues in a Java application running in a Docker container can be challenging, but here are some steps to help you determine if CA certificates are being loaded correctly:

Verify CA Certificates in Docker Image: Ensure that the CA certificates are correctly installed in your Alpine-based Docker image. You can check this by running the following command inside your container:
```
docker exec -it <container_id> /bin/sh
```
Then, within the container, verify that the CA certificates are present:
```
ls -l /etc/ssl/certs/
```

or in your case:

```sh
/usr/local/share/ca-certificates/
```

If you don't see the expected certificates, you might need to install them:

   apk add --no-cache ca-certificates

Check Java Truststore: Java uses its own truststore for SSL/TLS connections. You can check if the default Java truststore includes the necessary CA certificates:
```
keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit
```
Replace $JAVA_HOME with the path to your Java installation.
Specify Custom Truststore: If you are using a custom truststore, ensure that your Java application is configured to use it. You can set the truststore and password via JVM options:
```
java -Djavax.net.ssl.trustStore=/path/to/truststore -Djavax.net.ssl.trustStorePassword=yourpassword -jar yourapp.jar
```
Debug SSL Connections: Enable SSL debugging to get more detailed information about the SSL connection process. This can help you pinpoint where the connection is failing:
```
java -Djavax.net.debug=ssl -jar yourapp.jar
```
This will output detailed debug information to the console, which can help identify issues with certificate loading or SSL handshake.
Network Issues: Ensure there are no network issues causing the Connection reset error. Verify connectivity to the service from within the container:
```
curl -v https://your-service-url
```
Update Certificates: Sometimes, the CA certificates bundled with Alpine or OpenJDK might be outdated. Update them to the latest versions:
```
apk update && apk upgrade
apk add --no-cache ca-certificates
update-ca-certificates
```

Logs and Errors: Check the logs and errors for more detailed information about the exception:

try {
   // Your SSL connection code
} catch (javax.net.ssl.SSLException e) {
   e.printStackTrace();
}

By following these steps, you should be able to determine whether the CA certificates are being loaded correctly and identify the root cause of the javax.net.ssl.SSLException: Connection reset error.

adoptium / adoptium-support

javax.net.ssl.SSLException: Connection reset error with OpenJDK Alpine #1123