{"record":{"id":"77116981c6752e40","repo":"GoogleContainerTools/jib","slug":"platform-does-not-support-tls-protocol","errorCode":null,"errorMessage":"platform does not support TLS protocol","messagePattern":"platform does not support TLS protocol","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java","lineNumber":122,"sourceCode":"    HttpClientBuilder httpClientBuilder =\n        ApacheHttpTransport.newDefaultHttpClientBuilder()\n            // using \"system socket factory\" to enable sending client certificate\n            // https://github.com/GoogleContainerTools/jib/issues/2585\n            .setSSLSocketFactory(SSLConnectionSocketFactory.getSystemSocketFactory());\n    return new ApacheHttpTransport(httpClientBuilder.build());\n  }\n\n  private static HttpTransport getInsecureHttpTransport() {\n    try {\n      HttpClientBuilder httpClientBuilder =\n          ApacheHttpTransport.newDefaultHttpClientBuilder()\n              .setSSLSocketFactory(null) // creates new factory with the SSLContext given below\n              .setSSLContext(SslUtils.trustAllSSLContext())\n              .setSSLHostnameVerifier(new NoopHostnameVerifier());\n      // Do not use NetHttpTransport. See comments in getConnectionFactory for details.\n      return new ApacheHttpTransport(httpClientBuilder.build());\n    } catch (GeneralSecurityException ex) {\n      throw new RuntimeException(\"platform does not support TLS protocol\", ex);\n    }\n  }\n\n  private final boolean enableHttpAndInsecureFailover;\n  private final boolean sendAuthorizationOverHttp;\n  private final Consumer<LogEvent> logger;\n  private final Supplier<HttpTransport> secureHttpTransportFactory;\n  private final Supplier<HttpTransport> insecureHttpTransportFactory;\n\n  private final ConcurrentHashMap<String, Failover> failoverHistory = new ConcurrentHashMap<>();\n\n  private final Deque<HttpTransport> transportsCreated = new ArrayDeque<>();\n  private final Deque<Response> responsesCreated = new ArrayDeque<>();\n  private final boolean enableRetry;\n\n  /**\n   * Create a new FailoverHttpclient.\n   *","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java#L104-L140","documentation":"When building the insecure-failover HTTPS transport (trust-all SSL context), FailoverHttpClient needs the platform's TLS implementation. If SslUtils.trustAllSSLContext() or related setup throws GeneralSecurityException, the JVM/platform does not support TLS, and this RuntimeException is thrown.","triggerScenarios":"Calling Jib registry operations with insecure failover enabled (sendCredentialsOverHttp / allowInsecureRegistries) on a JVM missing TLS support (e.g. no TLS providers, stripped JRE, FIPS-restricted environment blocking default TLS).","commonSituations":"Minimal/headless JRE images without crypto providers, FIPS-only environments where the default SSLContext algorithm is disabled, corrupted JVM installations.","solutions":["Use a full JDK/JRE with standard TLS providers","Check java.security for disabled algorithms (jdk.tls.disabledAlgorithms) blocking your TLS version","Remove FIPS/exotic security configuration or configure a compliant SSLContext","Upgrade the JVM to a current version"],"exampleFix":"// before\n// stripped JRE without TLS\nFROM scratch-copy-of-jre\n// after\nFROM eclipse-temurin:17-jre","handlingStrategy":"fallback","validationCode":"try { javax.net.ssl.SSLContext.getDefault(); } catch (Exception e) { throw new IllegalStateException(\"No TLS support on this JVM\", e); }","typeGuard":"boolean tlsSupported() { try { return javax.net.ssl.SSLContext.getDefault().getProtocol() != null; } catch (Exception e) { return false; } }","tryCatchPattern":"try { jibStep(); } catch (RuntimeException e) { if (e.getMessage().contains(\"does not support TLS protocol\")) { failBuild(\"Use a JVM with TLS support\"); } throw e; }","preventionTips":["Use full JDK/JRE images, not stripped crypto-less builds","Review jdk.tls.disabledAlgorithms in FIPS environments","Test TLS connectivity to your registry before Jib builds"],"tags":["tls","ssl","network","jvm","unsupported-platform"],"backgroundTag":"unsupported-platform","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}