{"record":{"id":"8aa31278823cd4e3","repo":"GoogleContainerTools/jib","slug":"server-requires-https-but-is-not-https-secure","errorCode":null,"errorMessage":"Server requires HTTPS but is not HTTPS-secure","messagePattern":"Server requires HTTPS but is not HTTPS-secure","errorType":"exception","errorClass":"InsecureRegistryException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java","lineNumber":179,"sourceCode":"          } else {\n            // Credentials are either missing or wrong.\n            throw new RegistryUnauthorizedException(serverUrl, imageName, responseException);\n          }\n\n        } else {\n          // Unknown\n          throw responseException;\n        }\n      }\n\n    } catch (IOException ex) {\n      logError(\"I/O error for image [\" + serverUrl + \"/\" + imageName + \"]:\");\n      logError(\"    \" + ex.getClass().getName());\n      logError(\"    \" + (ex.getMessage() == null ? \"(null exception message)\" : ex.getMessage()));\n      logErrorIfBrokenPipe(ex);\n\n      if (ex instanceof SSLException) {\n        throw new InsecureRegistryException(url, ex);\n      }\n      throw ex;\n    }\n  }\n\n  @VisibleForTesting\n  RegistryErrorException newRegistryErrorException(ResponseException responseException) {\n    RegistryErrorExceptionBuilder registryErrorExceptionBuilder =\n        new RegistryErrorExceptionBuilder(\n            registryEndpointProvider.getActionDescription(), responseException);\n    if (responseException.getContent() != null) {\n      try {\n        ErrorResponseTemplate errorResponse =\n            JsonTemplateMapper.readJson(\n                responseException.getContent(), ErrorResponseTemplate.class);\n        for (ErrorEntryTemplate errorEntry : errorResponse.getErrors()) {\n          registryErrorExceptionBuilder.addReason(errorEntry);\n        }","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryEndpointCaller.java#L161-L197","documentation":"InsecureRegistryException is thrown when the connection to the registry fails with an SSLException, i.e. the server requires HTTPS but Jib could not establish a TLS connection (bad certificate, self-signed cert, plain-HTTP endpoint). Jib wraps it so users know the registry is not HTTPS-secure rather than a generic I/O failure.","triggerScenarios":"Connecting to a registry over http:// or with a self-signed/untrusted certificate; SSL handshake exception during the registry call; corporate proxy intercepting TLS.","commonSituations":"Running a local registry (localhost:5000) without TLS config; internal registry with a private CA whose cert is not in the JVM truststore; mitm proxy at work replacing certificates.","solutions":["Make the registry serve valid TLS with a certificate trusted by the JVM truststore.","For private CAs, import the CA cert into the Java truststore: keytool -importcert -alias myca -cacerts.","For local/test registries, use a trusted TLS setup or configure Docker/client to allow insecure registries where supported.","Check that the registry URL uses https:// and no proxy is stripping TLS."],"exampleFix":"// before\nto { image = 'localhost:5000/myapp' } // plain HTTP\n// after: start registry with TLS or import cert\nkeytool -importcert -file registry.crt -alias localreg -cacerts -storepass changeit","handlingStrategy":"validation","validationCode":"// Pre-check TLS connectivity\ntry (var s = javax.net.ssl.SSLSocketFactory.getDefault().createSocket(host, 443)) { s.startHandshake(); }","typeGuard":null,"tryCatchPattern":"try { extract(); } catch (InsecureRegistryException e) { logger.error(\"Registry {} has untrusted TLS: import its CA cert into the JVM truststore\", e.getUrl()); }","preventionTips":["Serve registries with valid, CA-signed certificates.","Import private CA certs into the JVM cacerts truststore.","Avoid plain-HTTP registry endpoints.","Test registry TLS with `curl https://registry/v2/` before building."],"tags":["ssl","tls","registry","network"],"backgroundTag":"invalid-url","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}