search

adoptium / containers

Repo containing the dockerfiles and scripts to produce the official eclipse-temurin containers.
https://hub.docker.com/_/eclipse-temurin/
Apache License 2.0
216 stars 93 forks source link

[Bug]: SSL Handshake exception using JDK 21 Alpine image #520

Closed axelfontaine closed 6 months ago

axelfontaine commented 6 months ago

Please add the exact image (with tag) that you are using

eclipse-temurin:21.0.2_13-jdk-alpine

Please add the version of Docker you are running

Docker version 25.0.3, build 4debf41

What happened?

Connecting to api.github.com works fine with temurin-21 outside a container, but failed with javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure in the Alpine container.

Adding -Djdk.tls.client.protocols=TLSv1.2 works around the issue.

TLS debug output diff before and after: https://www.diffchecker.com/B2NJEm7o/

Relevant log output

javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.370 GMT|null:-1|Stateless resumption supported
javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.370 GMT|null:-1|Ignore, context unavailable extension: cookie
javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.373 GMT|null:-1|Ignore, context unavailable extension: renegotiation_info
javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.373 GMT|null:-1|No session to resume.
javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.373 GMT|null:-1|Ignore, context unavailable extension: pre_shared_key
javax.net.ssl|DEBUG|15||2024-03-20 21:52:24.375 GMT|null:-1|Produced ClientHello handshake message (
"ClientHello": {
  "client version"      : "TLSv1.2",
  "random"              : "46CCB0FD0CDC0B5B6F691DF765C2E505B5E1A7936E31B08D4D16506FFCF84DD1",
  "session id"          : "6C662DF56E238B1DE668083C674C31458B4FD8E39D78717E550233F2105385DE",
  "cipher suites"       : "[TLS_AES_256_GCM_SHA384(0x1302), TLS_AES_128_GCM_SHA256(0x1301), TLS_CHACHA20_POLY1305_SHA256(0x1303), TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x009F), TLS_DHE_RSA_WITH_CHACHA20
_POLY1305_SHA256(0xCCAA), TLS_DHE_DSS_WITH_AES_256_GCM_SHA384(0x00A3), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256(0x009E), TLS_DHE_DSS_WITH_AES_128_GCM_SHA256(0x00A2), TLS_DHE_RSA_WITH_AES_256_CBC_SHA256(0x0
06B), TLS_DHE_DSS_WITH_AES_256_CBC_SHA256(0x006A), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256(0x0067), TLS_DHE_DSS_WITH_AES_128_CBC_SHA256(0x0040), TLS_DHE_RSA_WITH_AES_256_CBC_SHA(0x0039), TLS_DHE_DSS_WITH_
AES_256_CBC_SHA(0x0038), TLS_DHE_RSA_WITH_AES_128_CBC_SHA(0x0033), TLS_DHE_DSS_WITH_AES_128_CBC_SHA(0x0032), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_RSA_WITH_AES_256_CBC_SHA256(0x003D), TLS_RSA_WITH_AES_128_CBC_SHA256(0x003C), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F), TLS_EMPTY_RENEGOTIATION_INFO_SCSV(0x00FF)]",       
  "compression methods" : "00",
  "extensions"          : [
    "server_name (0)": {
      type=host_name (0), value=api.github.com
    },
    "status_request (5)": {
      "certificate status type": ocsp
      "OCSP status request": {
        "responder_id": <empty>
        "request extensions": {
          <empty>
        }
      }
    },
    "supported_groups (10)": {
      "named groups": [ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192]
    },
    "ec_point_formats (11)": {
      "formats": [uncompressed]
    },
    "application_layer_protocol_negotiation (16)": {
      [h2, http/1.1]
    },
    "status_request_v2 (17)": {
      "cert status request": {
        "certificate status type": ocsp_multi
        "OCSP status request": {
          "responder_id": <empty>
          "request extensions": {
            <empty>
          }
        }
      }
    },
    "extended_master_secret (23)": {
    "extended_master_secret (23)": {
      <empty>
    },
    "session_ticket (35)": {
      <empty>
    },
    "signature_algorithms (13)": {
      "signature schemes": [rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, rsa_sha224, dsa_sha224, rsa_pkcs1_sha1, dsa_sha1]
    },
    "supported_versions (43)": {
      "versions": [TLSv1.3, TLSv1.2]
    },
    "psk_key_exchange_modes (45)": {
      "ke_modes": [psk_dhe_ke]
    },
    "signature_algorithms_cert (50)": {
      "signature schemes": [rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, rsa_sha224, dsa_sha224, rsa_pkcs1_sha1, dsa_sha1]
    },
    "key_share (51)": {
      "client_shares": [
        {
          "named group": ffdhe2048
          "key_exchange": {
            0000: 51 88 E6 54 B7 8E E3 0F   F8 42 47 EF 69 72 5A A5  Q..T.....BG.irZ.
            0010: EF EE 2F CC A4 65 48 8B   63 21 17 94 26 66 4B 06  ../..eH.c!..&fK.
            0020: 73 A4 47 02 B3 75 25 CD   33 24 67 03 7C 03 AA 23  s.G..u%.3$g....#
            0030: B1 52 C5 49 72 70 F9 82   72 05 A8 C3 CF DD 8B 0F  .R.Irp..r.......
            0040: 4D AB DD 68 14 E6 4D DC   DC DF D5 3D F3 A9 1C 2F  M..h..M....=.../
            0050: 7D 61 50 EA 37 AA 16 02   41 93 27 21 5C 59 EE A8  .aP.7...A.'!\Y..
            0060: 01 59 F9 7B 16 65 FF AA   EB BB 14 B3 1C 5D B1 67  .Y...e.......].g
            0070: 44 B5 F7 2E 0F 44 C3 8D   5C CF B3 3C 7E 63 27 E8  D....D..\..<.c'.
            0080: 53 C1 8E 31 AB 8C 01 A2   C1 9B A2 48 BF 21 B2 0D  S..1.......H.!..
            0090: 74 2E 91 DB 23 72 B8 D5   41 01 C6 07 FD BD 8A 40  t...#r..A......@
            00A0: 85 83 DA 73 4A 05 20 13   E6 6D 3C 61 78 F0 5D F8  ...sJ. ..m<ax.].
            00B0: E1 EC F2 7D 73 40 A3 80   7C D8 EE 91 58 CB 04 45  ....s@......X..E
            00C0: AB 53 0C BB 10 40 04 6A   8D FC 58 21 F8 B2 D0 DD  .S...@.j..X!....
            00D0: 1C 4C 82 BB 08 E6 13 E2   3F 87 A1 45 4C 53 E1 E7  .L......?..ELS..
            00E0: 56 28 78 76 E7 36 A9 55   1C 97 D3 1E EA E1 AF CE  V(xv.6.U........
            00F0: 20 F3 06 36 3D F9 00 AE   8E C1 07 18 2F E7 B7 6C   ..6=......./..l
          }
        },
      ]
    }
  ]
}
)
javax.net.ssl|DEBUG|35||2024-03-20 21:52:24.400 GMT|null:-1|Received alert message (
"Alert": {
  "level"      : "fatal",
  "description": "handshake_failure"
}
)
javax.net.ssl|ERROR|35||2024-03-20 21:52:24.400 GMT|null:-1|Fatal (HANDSHAKE_FAILURE): Received fatal alert: handshake_failure (
"throwable" : {
  javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLEngineImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
        at java.base/javax.net.ssl.SSLEngine.unwrap(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate$Reader.unwrapBuffer(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate$Reader.processData(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SSLFlowDelegate$Reader$ReaderDownstreamPusher.run(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SequentialScheduler$LockingRestartableTask.run(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(Unknown Source)
        at java.net.http/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(Unknown Source)
        at java.base/java.util.concurrent.ThreadPerTaskExecutor$TaskRunner.run(Unknown Source)
        at java.base/java.lang.VirtualThread.run(Unknown Source)}

)

Update

Also faced the same issue with amazoncorretto:21.0.2-alpine3.19 image, so the problem most likely lies upstream. Any pointers welcome.

karianna commented 6 months ago

@axelfontaine Does this happen on a non-Alpine container (if you can text)?

axelfontaine commented 6 months ago

@karianna Just tried with eclipse-temurin:21.0.2_13-jdk, same thing!

axelfontaine commented 6 months ago

Never mind. I have built a jlink image and it didn't include the jdk.crypto.ec module as jdeps doesn't pick that up automatically. Sorry for the trouble.

Similar to