{"record":{"id":"1c08a20835bb398c","repo":"GoogleContainerTools/jib","slug":"cannot-verify-server-at-url-attempting-again-w","errorCode":null,"errorMessage":"Cannot verify server at ${url}. Attempting again with no TLS verification.","messagePattern":"Cannot verify server at (.+?)\\. Attempting again with no TLS verification\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java","lineNumber":391,"sourceCode":"  }\n\n  private HttpTransport getHttpTransport(boolean secureTransport) {\n    HttpTransport transport =\n        secureTransport ? secureHttpTransportFactory.get() : insecureHttpTransportFactory.get();\n    synchronized (transportsCreated) {\n      transportsCreated.add(transport);\n    }\n    return transport;\n  }\n\n  private void logHttpFailover(URL url) {\n    String log = \"Failed to connect to \" + url + \" over HTTPS. Attempting again with HTTP.\";\n    logger.accept(LogEvent.warn(log));\n  }\n\n  private void logInsecureHttpsFailover(URL url) {\n    String log = \"Cannot verify server at \" + url + \". Attempting again with no TLS verification.\";\n    logger.accept(LogEvent.warn(log));\n  }\n\n  @VisibleForTesting\n  public Deque<HttpTransport> getTransportsCreated() {\n    return transportsCreated;\n  }\n}\n","sourceCodeStart":373,"sourceCodeEnd":399,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java#L373-L399","documentation":"FailoverHttpClient logs this warning when the HTTPS connection to a registry cannot be TLS-verified (untrusted/unknown certificate, self-signed CA) and the client retries the request with all TLS certificate verification disabled. It warns that the connection is no longer authenticated or secure.","triggerScenarios":"A registry endpoint presents a certificate that fails Java's default trust validation (self-signed, private CA not in the JVM truststore, MITM proxy) while insecure-registries mode is enabled, triggering logInsecureHttpsFailover from the transport call path.","commonSituations":"Self-signed certificates on internal Harbor/Nexus registries; corporate proxy re-signing TLS; JVM truststore missing the internal CA; expired certificates on private registries.","solutions":["Import the registry's CA certificate into the JVM truststore (keytool -importcert -alias <ca> -keystore $JAVA_HOME/lib/security/cacerts)","Fix the registry certificate (valid CA-signed, not expired, correct SANs)","Explicitly opt into insecure mode for this registry so the behavior is intentional and audited","Investigate unexpected MITM if the endpoint should have a valid public certificate"],"exampleFix":"// before: warning about unverifiable cert\nmvn jib:build\n// after: trust the internal CA\nsudo keytool -importcert -file internal-ca.crt -alias internalCA -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit","handlingStrategy":"validation","validationCode":"// verify the registry certificate chains to a trusted CA\nopenssl s_client -connect registry.internal:443 -servername registry.internal </dev/null 2>/dev/null | openssl x509 -noout -issuer","typeGuard":null,"tryCatchPattern":"try {\n  jibBuild();\n} catch (SSLHandshakeException e) {\n  // after the 'no TLS verification' warning, fix trust rather than ignoring\n  throw new ConfigurationException(\"Import the registry CA into the JVM truststore\", e);\n}","preventionTips":["Import internal CAs into $JAVA_HOME/lib/security/cacerts (or -Djavax.net.ssl.trustStore)","Monitor certificate expiry for internal registries","Prefer explicit insecure-registry opt-in over silently disabling TLS verification"],"tags":["tls","certificate","truststore","jib"],"backgroundTag":"tls-certificate-verification-failed","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}