GoogleContainerTools/jib · critical · RuntimeException

platform does not support TLS protocol

Error message

platform does not support TLS protocol

What it means

When building the insecure-failover HTTPS transport (trust-all SSL context), FailoverHttpClient needs the platform's TLS implementation. If SslUtils.trustAllSSLContext() or related setup throws GeneralSecurityException, the JVM/platform does not support TLS, and this RuntimeException is thrown.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java:122

    HttpClientBuilder httpClientBuilder =
        ApacheHttpTransport.newDefaultHttpClientBuilder()
            // using "system socket factory" to enable sending client certificate
            // https://github.com/GoogleContainerTools/jib/issues/2585
            .setSSLSocketFactory(SSLConnectionSocketFactory.getSystemSocketFactory());
    return new ApacheHttpTransport(httpClientBuilder.build());
  }

  private static HttpTransport getInsecureHttpTransport() {
    try {
      HttpClientBuilder httpClientBuilder =
          ApacheHttpTransport.newDefaultHttpClientBuilder()
              .setSSLSocketFactory(null) // creates new factory with the SSLContext given below
              .setSSLContext(SslUtils.trustAllSSLContext())
              .setSSLHostnameVerifier(new NoopHostnameVerifier());
      // Do not use NetHttpTransport. See comments in getConnectionFactory for details.
      return new ApacheHttpTransport(httpClientBuilder.build());
    } catch (GeneralSecurityException ex) {
      throw new RuntimeException("platform does not support TLS protocol", ex);
    }
  }

  private final boolean enableHttpAndInsecureFailover;
  private final boolean sendAuthorizationOverHttp;
  private final Consumer<LogEvent> logger;
  private final Supplier<HttpTransport> secureHttpTransportFactory;
  private final Supplier<HttpTransport> insecureHttpTransportFactory;

  private final ConcurrentHashMap<String, Failover> failoverHistory = new ConcurrentHashMap<>();

  private final Deque<HttpTransport> transportsCreated = new ArrayDeque<>();
  private final Deque<Response> responsesCreated = new ArrayDeque<>();
  private final boolean enableRetry;

  /**
   * Create a new FailoverHttpclient.
   *

View on GitHub (pinned to fb949e2676)

Solutions

1. Use a full JDK/JRE with standard TLS providers
2. Check java.security for disabled algorithms (jdk.tls.disabledAlgorithms) blocking your TLS version
3. Remove FIPS/exotic security configuration or configure a compliant SSLContext
4. Upgrade the JVM to a current version

Example fix

// before
// stripped JRE without TLS
FROM scratch-copy-of-jre
// after
FROM eclipse-temurin:17-jre

try { javax.net.ssl.SSLContext.getDefault(); } catch (Exception e) { throw new IllegalStateException("No TLS support on this JVM", e); }

boolean tlsSupported() { try { return javax.net.ssl.SSLContext.getDefault().getProtocol() != null; } catch (Exception e) { return false; } }

try { jibStep(); } catch (RuntimeException e) { if (e.getMessage().contains("does not support TLS protocol")) { failBuild("Use a JVM with TLS support"); } throw e; }

When it happens

Trigger: Calling Jib registry operations with insecure failover enabled (sendCredentialsOverHttp / allowInsecureRegistries) on a JVM missing TLS support (e.g. no TLS providers, stripped JRE, FIPS-restricted environment blocking default TLS).

Common situations: Minimal/headless JRE images without crypto providers, FIPS-only environments where the default SSLContext algorithm is disabled, corrupted JVM installations.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Server requires HTTPS but is not HTTPS-secure
• Unknown OS: + rawOsName
• SHA-256 algorithm implementation not found - might be a brok
• SHA-256 algorithm implementation not found - might be a brok
• SHA-256 algorithm produced invalid hash: + ex.getMessage()

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/77116981c6752e40. Report an issue: GitHub.