{"record":{"id":"7c210e376d6b49a8","repo":"GoogleContainerTools/jib","slug":"failed-to-connect-to-url-over-https-attempting","errorCode":null,"errorMessage":"Failed to connect to ${url} over HTTPS. Attempting again with HTTP.","messagePattern":"Failed to connect to (.+?) over HTTPS\\. Attempting again with HTTP\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java","lineNumber":386,"sourceCode":"        }\n        logger.accept(LogEvent.warn(requestUrl + \" failed and will NOT be retried\"));\n        return false;\n      }\n    };\n  }\n\n  private HttpTransport getHttpTransport(boolean secureTransport) {\n    HttpTransport transport =\n        secureTransport ? secureHttpTransportFactory.get() : insecureHttpTransportFactory.get();\n    synchronized (transportsCreated) {\n      transportsCreated.add(transport);\n    }\n    return transport;\n  }\n\n  private void logHttpFailover(URL url) {\n    String log = \"Failed to connect to \" + url + \" over HTTPS. Attempting again with HTTP.\";\n    logger.accept(LogEvent.warn(log));\n  }\n\n  private void logInsecureHttpsFailover(URL url) {\n    String log = \"Cannot verify server at \" + url + \". Attempting again with no TLS verification.\";\n    logger.accept(LogEvent.warn(log));\n  }\n\n  @VisibleForTesting\n  public Deque<HttpTransport> getTransportsCreated() {\n    return transportsCreated;\n  }\n}\n","sourceCodeStart":368,"sourceCodeEnd":399,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/http/FailoverHttpClient.java#L368-L399","documentation":"FailoverHttpClient logs this warning when a plain HTTPS connection to a registry fails (e.g. SSL handshake or connect error) and the client automatically falls back to unencrypted HTTP for that URL. It signals degraded security: credentials may be sent over HTTP.","triggerScenarios":"Calling any registry operation (pull/push) against a URL whose HTTPS endpoint is unreachable (TLS handshake failure, no HTTPS listener) when the client allows insecure/plain-HTTP failover (allowInsecureRegistries enabled or a registry configured as insecure).","commonSituations":"Private registries (e.g. old Docker registries, Harbor misconfig, local registries) that only serve plain HTTP on :5000; corporate TLS-inspecting proxies; testing against localhost registries without TLS.","solutions":["Enable TLS on the registry or configure the registry as insecure explicitly (--allow-insecure-registries / sendCredentialsOverHttp) so the fallback is intentional","Fix the HTTPS endpoint: check certificate validity, TLS version, and that port 443 serves TLS (curl -v https://<url>)","Avoid sending real credentials over the plain-HTTP fallback; use a transport-secured proxy in front of the registry","If the registry must stay HTTP-only, restrict it to trusted/internal networks"],"exampleFix":"// before: registry only serves HTTP, credentials sent in clear\nmvn jib:build -Djib.to.image=registry.local:5000/app\n// after: explicitly acknowledge insecure registry\nmvn jib:build -Djib.allowInsecureRegistries=registry.local:5000","handlingStrategy":"validation","validationCode":"// ensure the registry speaks HTTPS before building\nopenssl s_client -connect registry.local:443 -servername registry.local </dev/null | grep -q 'Verify return code: 0' && echo OK","typeGuard":null,"tryCatchPattern":"try {\n  jibBuild();\n} catch (Exception e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Attempting again with HTTP\")) {\n    log.warn(\"Credentials may have gone over plain HTTP; enable TLS on the registry\");\n  }\n  throw e;\n}","preventionTips":["Always serve TLS on private registries","Declare insecure registries explicitly so plain-HTTP fallback is intentional","Never send real credentials to HTTP-only endpoints over untrusted networks"],"tags":["https","tls","fallback","jib"],"backgroundTag":"http-request-failed","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}