Wildfly with java 11 startup error javax.net.ssl

Question

I am using java 11 and wildfly 23 - however when i try to start it up i get the below error.

17:30:36,489 ERROR [stderr] (MSC service thread 1-4) javax.net.ssl|DEBUG|13|MSC service thread 1-4| |SSLCipher.java:437|jdk.tls.keyLimits:  entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472

I have configured the security realm with keystore and password as below.

 <security-realm name="secRealm">
                <server-identities>
                    <ssl>
                        <keystore provider="${javax.net.ssl.keyStoreType}" path="${javax.net.ssl.keyStore}" keystore-password="${javax.net.ssl.keyStorePassword}" alias="testcert"/>
                    </ssl>
                </server-identities>
            </security-realm>

I am not sure what is causing the error - however, i suspect that i might need to import certs into jdk 11 security.

Also is it possible to specify trustStore and trustStorePassword on wildfly standalone xml ?

I have also tried to specify the truststore on startup jvm options, standalone.conf

#
# Specify options to pass to the Java VM.
#
if [ "x$JAVA_OPTS" = "x" ]; then
   JAVA_OPTS="-Xms512m -Xmx1024m -XX:MetaspaceSize=256m -XX:MaxMetaspaceSize=512m -Djava.net.preferIPv4Stack=true"
   JAVA_OPTS="$JAVA_OPTS -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS -Djava.awt.headless=true"
  JAVA_OPTS="$JAVA_OPTS   -Djavax.net.ssl.trustStore=path -Djavax.net.ssl.trustStorePassword=password -Djavax.net.debug=all"
else
   echo "JAVA_OPTS already set in environment; overriding default settings with values: $JAVA_OPTS"
fi

However i keep getting the same or similar error

AST|TransportContext.java:313|Fatal (INTERNAL_ERROR): problem unwrapping net record (
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6) "throwable" : {
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)   javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:146)
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:64)
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:548)
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:443)
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:422)
2021-09-15 14:33:49,430 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.protocols.ssl.SslConduit.doUnwrap(SslConduit.java:762)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.protocols.ssl.SslConduit.read(SslConduit.java:587)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.conduits.ConduitStreamSourceChannel.read(ConduitStreamSourceChannel.java:127)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.server.protocol.http.HttpReadListener.handleEventWithNoRunningRequest(HttpReadListener.java:158)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.server.protocol.http.HttpReadListener.handleEvent(HttpReadListener.java:136)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:162)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:100)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at io.undertow.core@2.2.5.Final//io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:57)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
2021-09-15 14:33:49,431 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:291)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:286)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners$DelegatingChannelListener.handleEvent(ChannelListeners.java:1092)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio@3.8.4.Final//org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio.nio@3.8.4.Final//org.xnio.nio.QueuedNioTcpServer2.acceptTask(QueuedNioTcpServer2.java:178)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio.nio@3.8.4.Final//org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:612)
2021-09-15 14:33:49,432 ERROR [stderr] (default I/O-6)       at org.jboss.xnio.nio@3.8.4.Final//org.xnio.nio.WorkerThread.run(WorkerThread.java:479)}

The first item about KEYUPDATE is not an error; although written to stderr (because that is where JSSE logging goes) it has level DEBUG. The error you are getting has nothing at all to do with any certificate(s); it is a malformed message and as the exception message suggests probably because your client is sending plaintext and NOT SSL/TLS i.e. not HTTPS. — dave_thompson_085, Sep 17 '21 at 14:42
This appeared when i have `` and also noticed that the client was pushing http instead of a riderect url HTTPS — Dev Fh, Sep 17 '21 at 17:37
Yes that property does debug logging, and yes if the client does HTTP instead of HTTPS that causes your error. Get the client to stop doing HTTP on an HTTPS port. If you are issuing a redirect telling them to use HTTP on an HTTPS port, don't do that. — dave_thompson_085, Sep 18 '21 at 12:12

Wildfly with java 11 startup error javax.net.ssl

0 Answers0