{"record":{"id":"bd9eb67e14593315","repo":"testcontainers/testcontainers-java","slug":"unable-to-create-custom-ssl-factory-instance","errorCode":null,"errorMessage":"Unable to create custom SSL factory instance","messagePattern":"Unable to create custom SSL factory instance","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/testcontainers/containers/wait/strategy/HttpWaitStrategy.java","lineNumber":369,"sourceCode":"\n                        @Override\n                        public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) {}\n\n                        @Override\n                        public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) {}\n\n                        @Override\n                        public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) {}\n                    },\n                };\n\n                try {\n                    // Create custom SSL context and set the \"trust all certificates\" trust manager\n                    final SSLContext sc = SSLContext.getInstance(\"SSL\");\n                    sc.init(new KeyManager[0], trustAllCerts, new SecureRandom());\n                    connection.setSSLSocketFactory(sc.getSocketFactory());\n                } catch (final NoSuchAlgorithmException | KeyManagementException ex) {\n                    throw new IOException(\"Unable to create custom SSL factory instance\", ex);\n                }\n            }\n\n            return connection;\n        } else {\n            return (HttpURLConnection) new URL(uri).openConnection();\n        }\n    }\n\n    /**\n     * Build the URI on which to check if the container is ready.\n     *\n     * @param livenessCheckPort the liveness port\n     * @return the liveness URI\n     */\n    private URI buildLivenessUri(int livenessCheckPort) {\n        final String scheme = (tlsEnabled ? \"https\" : \"http\") + \"://\";\n        final String host = waitStrategyTarget.getHost();","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/core/src/main/java/org/testcontainers/containers/wait/strategy/HttpWaitStrategy.java#L351-L387","documentation":"When HttpWaitStrategy is configured with .usingTls().allowInsecure(), openConnection builds an SSLContext with a trust-all TrustManager and installs its socket factory on the connection. If SSLContext.getInstance(\"SSL\") or sc.init(...) throws (NoSuchAlgorithmException / KeyManagementException), the strategy wraps it in this IOException. It is an environment/JRE problem, not an app problem.","triggerScenarios":"Calling .usingTls(true).allowInsecure(true) on a JRE lacking the requested SSL algorithm or failing key-manager initialization (restricted crypto policy, broken security provider, unusual JRE build).","commonSituations":"Running on minimal/custom JRE builds (jlink images) missing crypto providers; ancient or exotic JVMs without 'SSL' algorithm; corporate JVM with stripped security providers.","solutions":["Check available algorithms: Security.getAlgorithms(\"SSLContext\") — use .usingTls() only if SSL/TLS is present","Run on a standard, full JDK/JRE (e.g. official Temurin images)","Upgrade the JVM/Testcontainers version; newer code may request \"TLS\" instead of \"SSL\"","If TLS is not actually needed, drop .usingTls() and wait over plain HTTP"],"exampleFix":"// before\nnew HttpWaitStrategy().usingTls().allowInsecure().forPort(8443);\n// after\n// only if the endpoint really is HTTPS; otherwise wait over HTTP\nnew HttpWaitStrategy().forPort(8080);","handlingStrategy":"try-catch","validationCode":"// Ensure the JVM can create the SSL context before configuring TLS waits\nif (!java.security.Security.getAlgorithms(\"SSLContext\").stream()\n        .anyMatch(a -> a.equalsIgnoreCase(\"SSL\") || a.equalsIgnoreCase(\"TLS\"))) {\n    throw new IllegalStateException(\"No SSLContext provider available; avoid .usingTls()\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    container.waitingFor(new HttpWaitStrategy().usingTls().allowInsecure()).start();\n} catch (ContainerLaunchException e) {\n    Throwable root = e;\n    while (root.getCause() != null) root = root.getCause();\n    if (root instanceof NoSuchAlgorithmException || root instanceof KeyManagementException) {\n        // fall back to plain HTTP wait or fix the JRE\n    }\n    throw e;\n}","preventionTips":["Use full standard JDK/JRE images in test environments","Only enable .usingTls() when the endpoint truly serves HTTPS","Keep Testcontainers updated for SSL-handling fixes"],"tags":["ssl","tls","wait-strategy","jre","testcontainers"],"backgroundTag":"tls-handshake-failure","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}