{"record":{"id":"1326c04cbbea3401","repo":"karatelabs/karate","slug":"connect-failed","errorCode":"CONNECT_FAILED","errorMessage":"SSL context creation failed","messagePattern":"SSL context creation failed","errorType":"error_code","errorClass":"WsException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/http/WsClient.java","lineNumber":164,"sourceCode":"        }\n    }\n\n    private void doConnect() {\n        URI uri = options.getUri();\n        String scheme = uri.getScheme();\n        String host = options.getHost();\n        int port = options.getPort();\n\n        SslContext sslContext = null;\n        if (options.isSsl()) {\n            sslContext = options.getSslContext();\n            if (sslContext == null && options.isTrustAllCerts()) {\n                try {\n                    sslContext = SslContextBuilder.forClient()\n                            .trustManager(InsecureTrustManagerFactory.INSTANCE)\n                            .build();\n                } catch (SSLException e) {\n                    throw new WsException(WsException.Type.CONNECT_FAILED, \"SSL context creation failed\", e);\n                }\n            }\n        }\n\n        HttpHeaders headers = new DefaultHttpHeaders();\n        for (Map.Entry<String, String> entry : options.getHeaders().entrySet()) {\n            headers.add(entry.getKey(), entry.getValue());\n        }\n\n        WebSocketClientHandshaker handshaker = WebSocketClientHandshakerFactory.newHandshaker(\n                uri,\n                WebSocketVersion.V13,\n                options.getSubProtocol(),\n                options.isCompression(),\n                headers,\n                options.getMaxPayloadSize()\n        );\n","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/http/WsClient.java#L146-L182","documentation":"WsClient.doConnect builds a Netty SSLContext with an insecure trust manager when trustAllCerts is enabled. If building that SslContext throws SSLException, it is wrapped in a WsException with Type.CONNECT_FAILED. This means the TLS client stack could not be initialized, not that the server rejected the connection.","triggerScenarios":"Connecting a WebSocket with options.isTrustAllCerts() == true while SslContextBuilder.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE).build() throws — e.g. missing TLS provider, unavailable ALPN/OpenSSL natives, or JDK TLS restrictions.","commonSituations":"netty-tcnative/openssl availability problems; FIPS-restricted JVMs disabling the required algorithms; corrupted JDK security config (java.security, excluded algorithms); very old JDK combined with newer Netty TLS requirements.","solutions":["Inspect the wrapped SSLException cause for the exact algorithm/provider failure.","Ensure a supported JDK (8u252+/11+) with working SunJSSE; check jdk.tls.disabledAlgorithms in java.security.","Avoid trustAllCerts in production — configure a real trust store, which uses the default SSL path.","Check native TLS provider issues (add/remove netty-tcnative dependency) or force the JDK provider.","Retry after fixing the JVM security configuration; this is not a transient network error."],"exampleFix":"// before (fails in restricted JVM)\noptions.setTrustAllCerts(true);\n// after\noptions.setSslContext(customSslContextWithTrustStore); // avoid insecure builder path","handlingStrategy":"try-catch","validationCode":"// Java\nboolean cryptoOk;\ntry { javax.net.ssl.SSLContext.getDefault(); cryptoOk = true; } catch (Exception e) { cryptoOk = false; }","typeGuard":null,"tryCatchPattern":"try {\n    ws.connect();\n} catch (WsException e) {\n    if (e.getType() == WsException.Type.CONNECT_FAILED && e.getMessage().contains(\"SSL context creation failed\")) {\n        throw new IllegalStateException(\"TLS provider misconfiguration\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Keep JDK security config (java.security) unmodified","Prefer explicit trust stores over trustAllCerts","Verify TLS works at startup in restricted/FIPS environments","Match Netty version with JDK TLS capabilities"],"tags":["websocket","ssl","tls","netty"],"backgroundTag":"ssl-context-creation-failed","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}