What causes "Server requires HTTPS but is not HTTPS-secure" in GoogleContainerTools/jib?

Make the registry serve valid TLS with a certificate trusted by the JVM truststore.

GoogleContainerTools/jib · error · InsecureRegistryException

Server requires HTTPS but is not HTTPS-secure

Error message

Server requires HTTPS but is not HTTPS-secure

What it means

InsecureRegistryException is thrown when the connection to the registry fails with an SSLException, i.e. the server requires HTTPS but Jib could not establish a TLS connection (bad certificate, self-signed cert, plain-HTTP endpoint). Jib wraps it so users know the registry is not HTTPS-secure rather than a generic I/O failure.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java:179

          } else {
            // Credentials are either missing or wrong.
            throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);
          }

        } else {
          // Unknown
          throw responseException;
        }
      }

    } catch (IOException ex) {
      logError("I/O error for image [" + serverUrl + "/" + imageName + "]:");
      logError("    " + ex.getClass().getName());
      logError("    " + (ex.getMessage() == null ? "(null exception message)" : ex.getMessage()));
      logErrorIfBrokenPipe(ex);

      if (ex instanceof SSLException) {
        throw new InsecureRegistryException(url, ex);
      }
      throw ex;
    }
  }

  @VisibleForTesting
  RegistryErrorException newRegistryErrorException(ResponseException responseException) {
    RegistryErrorExceptionBuilder registryErrorExceptionBuilder =
        new RegistryErrorExceptionBuilder(
            registryEndpointProvider.getActionDescription(), responseException);
    if (responseException.getContent() != null) {
      try {
        ErrorResponseTemplate errorResponse =
            JsonTemplateMapper.readJson(
                responseException.getContent(), ErrorResponseTemplate.class);
        for (ErrorEntryTemplate errorEntry : errorResponse.getErrors()) {
          registryErrorExceptionBuilder.addReason(errorEntry);
        }

View on GitHub (pinned to fb949e2676)

Solutions

Make the registry serve valid TLS with a certificate trusted by the JVM truststore.
For private CAs, import the CA cert into the Java truststore: keytool -importcert -alias myca -cacerts.
For local/test registries, use a trusted TLS setup or configure Docker/client to allow insecure registries where supported.
Check that the registry URL uses https:// and no proxy is stripping TLS.

Example fix

// before
to { image = 'localhost:5000/myapp' } // plain HTTP
// after: start registry with TLS or import cert
keytool -importcert -file registry.crt -alias localreg -cacerts -storepass changeit

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check TLS connectivity
try (var s = javax.net.ssl.SSLSocketFactory.getDefault().createSocket(host, 443)) { s.startHandshake(); }

Try / catch

try { extract(); } catch (InsecureRegistryException e) { logger.error("Registry {} has untrusted TLS: import its CA cert into the JVM truststore", e.getUrl()); }

Prevention

Serve registries with valid, CA-signed certificates.
Import private CA certs into the JVM cacerts truststore.
Avoid plain-HTTP registry endpoints.
Test registry TLS with `curl https://registry/v2/` before building.

When it happens

Trigger: Connecting to a registry over http:// or with a self-signed/untrusted certificate; SSL handshake exception during the registry call; corporate proxy intercepting TLS.

Common situations: Running a local registry (localhost:5000) without TLS config; internal registry with a private CA whose cert is not in the JVM truststore; mitm proxy at work replacing certificates.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/8aa31278823cd4e3. Report an issue: GitHub.