9-jdk image has SSL issues

[keeganwitt]

9-b179-jdk image works fine, but the latest 9-jdk image is unable to make SSL connections in Java.

Here's how you can see the issue, create TestHttps.java with

import java.net.URL;
import javax.net.ssl.HttpsURLConnection;

public class TestHttps {
    public static void main(String[] args) {
        try {
            HttpsURLConnection conn = (HttpsURLConnection) new URL(args[0]).openConnection();
            conn.getResponseCode();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

and run

javac TestHttps.java
java -cp . TestHttps "https://www.google.com/"

You'll get

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/sun.security.ssl.Alerts.getSSLException(Alerts.java:214)
        at java.base/sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1969)
        at java.base/sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1921)
        at java.base/sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1904)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1436)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
        at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:567)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1563)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1491)
        at java.base/java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:527)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:320)
        at TestHttps.main(TestHttps.java:10)
Caused by: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:89)
        at java.base/sun.security.validator.Validator.getInstance(Validator.java:181)
        at java.base/sun.security.ssl.X509TrustManagerImpl.getValidator(X509TrustManagerImpl.java:330)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(X509TrustManagerImpl.java:180)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:192)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:133)
        at java.base/sun.security.ssl.ClientHandshaker.checkServerCerts(ClientHandshaker.java:1825)
        at java.base/sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1655)
        at java.base/sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:260)
        at java.base/sun.security.ssl.Handshaker.processLoop(Handshaker.java:1086)
        at java.base/sun.security.ssl.Handshaker.processRecord(Handshaker.java:1020)
        at java.base/sun.security.ssl.SSLSocketImpl.processInputRecord(SSLSocketImpl.java:1137)
        at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1074)
        at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
        at java.base/sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1402)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1429)
        ... 8 more
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
        at java.base/java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
        at java.base/java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
        at java.base/java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
        at java.base/sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:86)
        ... 23 more

[keeganwitt]

The same test with 9-jre fails with

Exception in thread "main" java.lang.ExceptionInInitializerError
        at java.base/javax.crypto.JceSecurityManager.<clinit>(JceSecurityManager.java:66)
        at java.base/javax.crypto.Cipher.getConfiguredPermission(Cipher.java:2610)
        at java.base/javax.crypto.Cipher.getMaxAllowedKeyLength(Cipher.java:2634)
        at java.base/sun.security.ssl.CipherSuite$BulkCipher.isUnlimited(CipherSuite.java:602)
        at java.base/sun.security.ssl.CipherSuite$BulkCipher.<init>(CipherSuite.java:574)
        at java.base/sun.security.ssl.CipherSuite$BulkCipher.<clinit>(CipherSuite.java:460)
        at java.base/sun.security.ssl.CipherSuite.<clinit>(CipherSuite.java:1074)
        at java.base/sun.security.ssl.SSLContextImpl.getApplicableSupportedCipherSuiteList(SSLContextImpl.java:354)
        at java.base/sun.security.ssl.SSLContextImpl.access$100(SSLContextImpl.java:42)
        at java.base/sun.security.ssl.SSLContextImpl$AbstractTLSContext.<clinit>(SSLContextImpl.java:590)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:292)
        at java.base/java.security.Provider$Service.getImplClass(Provider.java:1844)
        at java.base/java.security.Provider$Service.newInstance(Provider.java:1820)
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
        at java.base/javax.net.ssl.SSLContext.getInstance(SSLContext.java:169)
        at java.base/javax.net.ssl.SSLContext.getDefault(SSLContext.java:99)
        at java.base/javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:123)
        at java.base/javax.net.ssl.HttpsURLConnection.getDefaultSSLSocketFactory(HttpsURLConnection.java:335)
        at java.base/javax.net.ssl.HttpsURLConnection.<init>(HttpsURLConnection.java:292)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.<init>(HttpsURLConnectionImpl.java:86)
        at java.base/sun.net.www.protocol.https.Handler.openConnection(Handler.java:62)
        at java.base/sun.net.www.protocol.https.Handler.openConnection(Handler.java:57)
        at java.base/java.net.URL.openConnection(URL.java:1051)
        at TestHttps.main(TestHttps.java:9)
Caused by: java.lang.SecurityException: Can not initialize cryptographic mechanism
        at java.base/javax.crypto.JceSecurity.<clinit>(JceSecurity.java:118)
        ... 26 more
Caused by: java.lang.SecurityException: Can't read cryptographic policy directory: unlimited
        at java.base/javax.crypto.JceSecurity.setupJurisdictionPolicies(JceSecurity.java:324)
        at java.base/javax.crypto.JceSecurity.access$000(JceSecurity.java:73)
        at java.base/javax.crypto.JceSecurity$1.run(JceSecurity.java:109)
        at java.base/javax.crypto.JceSecurity$1.run(JceSecurity.java:106)
        at java.base/java.security.AccessController.doPrivileged(Native Method)
        at java.base/javax.crypto.JceSecurity.<clinit>(JceSecurity.java:105)
        ... 26 more

[aiannucci]

Faced same issue today with latest image 9-jdk

[yosifkit]

Works fine with jdk-slim or jre-slim, so there is something in the non-headless package that breaks things.

[mjw99]

Seeing this downstream with a Maven project on Bitbucket's pipelines.

[carlossg]

Easy reproducer with maven image in carlossg/docker-maven#50

docker run -it --rm maven:3-jdk-9 mvn dependency:tree

[queer]

Seeing this in the current 9-jre image as well.

[eolivelli]

I got this issue as well
this is a showstopper for upgrading the build pipeline to jdk9
any news ?

[philwebb]

It looks like the cacerts file in JDK 9 release (b181) is empty. It wasn't for the last version I tested (b176). I had to copy the truststore from b176 to make my builds pass again (reaching external https repos).

https://twitter.com/CedricChampeau/status/913679310896156672

[chiralsoftware]

My workaround to this: I have JDK 8 installed. I went in to JDK9_HOME/lib/security and did:

rm cacerts
ln -s /etc/ssl/certs/java/cacerts 

Problem solved. The cacerts file that comes with 181 is empty. After making that fix, Maven works as expected.

[yosifkit]

@chiralsoftware, I apparently don't understand how that fixes it; the file /usr/lib/jvm/java-9-openjdk-amd64/lib/security/cacerts is already a symlink to /etc/ssl/certs/java/cacerts.

$ docker run -it --rm openjdk:9-jdk bash
root@c555aa9be1c4:/# find / -name cacerts
/etc/default/cacerts
/etc/ssl/certs/java/cacerts
/usr/lib/jvm/java-9-openjdk-amd64/lib/security/cacerts
root@c555aa9be1c4:/# ls -l /usr/lib/jvm/java-9-openjdk-amd64/lib/security/cacerts
lrwxrwxrwx 1 root root 27 Aug 24 17:15 /usr/lib/jvm/java-9-openjdk-amd64/lib/security/cacerts -> /etc/ssl/certs/java/cacerts
root@c555aa9be1c4:/# exit

[chiralsoftware]

@yosifkit , I installed from the .tar.gz file

0afa4ff751925e039489b4690667aad746412567ffc71393d6a253001874e592 jdk-9+181_linux-x64_bin.tar.gz

That did not create the link when I untarred it. Creating that link fixed it. I haven't tried the other package files.

[yosifkit]

@chiralsoftware, I understand, this image uses the Debian packaging for openjdk, not the tar-gz file directly (we get many more architectures that way).