[GR-52698] Cannot run SSL debug logs with GraalVM native image #8564

TharmiganK · 2024-03-13T12:13:23Z

Describe the issue

I am trying to enable SSL debug logs by providing the -Djavax.net.debug=ssl flag with the native executable. But I am not getting any SSL logs

Steps to reproduce the issue

Download the zip file from this link.
Unzip the package

Build the native executable for the https_client.jar in the target/bin directory.

 $ native-image -jar target/bin/https_client.jar --no-fallback -H:Path=target/bin

Run the https_service.jar with SSL debug logs:

$ java -Djavax.net.debug=ssl -jar ./target/bin/https_server.jar

Run the client native executable with SSL debug logs:
```
$ ./target/bin/https_client -Djavax.net.debug=ssl
```

Describe GraalVM and your environment:

GraalVM version : CE 17.0.9+9.1
JDK major version: 17
OS: macOS Sonoma
Architecture: ARM64

$ native-image --version

native-image 17.0.9 2023-10-17
GraalVM Runtime Environment GraalVM CE 17.0.9+9.1 (build 17.0.9+9-jvmci-23.0-b22)
Substrate VM GraalVM CE 17.0.9+9.1 (build 17.0.9+9, serial gc)

More details

Related slack thread: https://graalvm.slack.com/archives/CN9KSFB40/p1710326823711189?thread_ts=1710171443.562749&cid=CN9KSFB40

Tried to initialise sun.security.ssl.SSLLogger at runtime but it did not work the following error is returned:

$ native-image -jar target/bin/https_client.jar --no-fallback --initialize-at-run-time=sun.security.ssl.SSLLogger -H:+ReportExceptionStackTraces -H:Path=target/bin

Error: Incompatible change of initialization policy for sun.security.ssl.SSLLogger: trying to change RUN_TIME from command line with 'sun.security.ssl.SSLLogger' to RERUN for reading properties at run time
com.oracle.svm.core.util.UserError$UserException: Incompatible change of initialization policy for sun.security.ssl.SSLLogger: trying to change RUN_TIME from command line with 'sun.security.ssl.SSLLogger' to RERUN for reading properties at run time
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.util.UserError.abort(UserError.java:73)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:103)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insert(ClassInitializationConfiguration.java:64)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ProvenSafeClassInitializationSupport.rerunInitialization(ProvenSafeClassInitializationSupport.java:162)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.SecurityServicesFeature.lambda$duringSetup$1(SecurityServicesFeature.java:309)
        at java.base/java.util.Optional.ifPresent(Optional.java:178)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.SecurityServicesFeature.duringSetup(SecurityServicesFeature.java:309)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.lambda$setupNativeImage$16(NativeImageGenerator.java:938)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.FeatureHandler.forEachFeature(FeatureHandler.java:89)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.setupNativeImage(NativeImageGenerator.java:938)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:579)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.run(NativeImageGenerator.java:539)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.buildImage(NativeImageGeneratorRunner.java:408)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.build(NativeImageGeneratorRunner.java:612)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.start(NativeImageGeneratorRunner.java:134)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.main(NativeImageGeneratorRunner.java:94)

The text was updated successfully, but these errors were encountered:

fernando-valdez · 2024-03-14T03:55:52Z

Created internal ticket: GR-52698

fernando-valdez · 2024-03-20T15:54:56Z

Hello @TharmiganK, please try to replace --initialize-at-run-time=sun.security.ssl.SSLLogger with --initialize-at-build-time=sun.security.ssl.SSLLogger and share your result

TharmiganK · 2024-03-21T07:27:12Z

Hello @TharmiganK, please try to replace --initialize-at-run-time=sun.security.ssl.SSLLogger with --initialize-at-build-time=sun.security.ssl.SSLLogger and share your result

@fernando-valdez Getting a similar error: (This is with GraalVM CE 17.0.9+9.1)

$ native-image -jar target/bin/https_client.jar --no-fallback -H:Path=target/bin --initialize-at-build-time=sun.security.ssl.SSLLogger -H:+ReportExceptionStackTraces

========================================================================================================================
GraalVM Native Image: Generating 'https_client' (executable)...
========================================================================================================================
[1/8] Initializing...
                                                                                    (0.0s @ 0.19GB)
Error: Incompatible change of initialization policy for sun.security.ssl.SSLLogger: trying to change BUILD_TIME from command line with 'sun.security.ssl.SSLLogger' to RERUN for reading properties at run time
com.oracle.svm.core.util.UserError$UserException: Incompatible change of initialization policy for sun.security.ssl.SSLLogger: trying to change BUILD_TIME from command line with 'sun.security.ssl.SSLLogger' to RERUN for reading properties at run time
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.util.UserError.abort(UserError.java:73)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:103)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insertRec(ClassInitializationConfiguration.java:117)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ClassInitializationConfiguration.insert(ClassInitializationConfiguration.java:64)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.classinitialization.ProvenSafeClassInitializationSupport.rerunInitialization(ProvenSafeClassInitializationSupport.java:162)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.SecurityServicesFeature.lambda$duringSetup$1(SecurityServicesFeature.java:309)
        at java.base/java.util.Optional.ifPresent(Optional.java:178)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.SecurityServicesFeature.duringSetup(SecurityServicesFeature.java:309)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.lambda$setupNativeImage$16(NativeImageGenerator.java:938)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.FeatureHandler.forEachFeature(FeatureHandler.java:89)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.setupNativeImage(NativeImageGenerator.java:938)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:579)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGenerator.run(NativeImageGenerator.java:539)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.buildImage(NativeImageGeneratorRunner.java:408)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.build(NativeImageGeneratorRunner.java:612)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.start(NativeImageGeneratorRunner.java:134)
        at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.main(NativeImageGeneratorRunner.java:94)
------------------------------------------------------------------------------------------------------------------------
                        0.5s (9.2% of total time) in 17 GCs | Peak RSS: 0.68GB | CPU load: 2.84
========================================================================================================================
Finished generating 'https_client' in 4.7s.

TharmiganK · 2024-03-27T04:03:06Z

@fernando-valdez any update on this issue?

aanavaneeth · 2024-04-04T07:56:50Z

Is there any issue with features leveraging jvm arguments in general? I am facing Kerberos related issue which depends on a jvm argument. #8674

TharmiganK · 2024-06-11T08:34:23Z

@fernando-valdez Any update on this issue? This is required to debug production issues with GraalVM native images?

gingk1212 · 2025-01-14T16:23:00Z

When I tested using the following code, it seemed that -Djavax.net.debug=ssl was working in my environment (Linux x64).

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URI;
import java.net.URL;

public class SSLDebugSample {
  public static void main(String[] args) {
    try {
      URL url = URI.create("https://www.example.com").toURL();
      HttpURLConnection connection = (HttpURLConnection) url.openConnection();
      connection.setRequestMethod("GET");
      try (BufferedReader in =
          new BufferedReader(new InputStreamReader(connection.getInputStream()))) {
        while (in.readLine() != null);
      }
      System.out.println("Request completed successfully.");
    } catch (Exception e) {
      e.printStackTrace();
    }
  }
}

Command:

$ javac SSLDebugSample.java
$ native-image SSLDebugSample --enable-url-protocols=https --no-fallback
$ ./ssldebugsample -Djavax.net.debug=ssl
javax.net.ssl|DEBUG|10|main|2025-01-15 01:19:57.293 JST|Utilities.java:74|the previous server name in SNI (type=host_name (0), value=www.example.com) was replaced with (type=host_name (0), value=www.example.com)
javax.net.ssl|DEBUG|10|main|2025-01-15 01:19:57.420 JST|SSLCipher.java:1870|KeyLimit read side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
javax.net.ssl|DEBUG|10|main|2025-01-15 01:19:57.420 JST|SSLCipher.java:2024|KeyLimit write side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
javax.net.ssl|DEBUG|10|main|2025-01-15 01:19:57.422 JST|SSLCipher.java:1870|KeyLimit read side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
javax.net.ssl|DEBUG|10|main|2025-01-15 01:19:57.422 JST|SSLCipher.java:2024|KeyLimit write side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
Request completed successfully.

With no flag:

$ ./ssldebugsample
Request completed successfully.

Version:

$ java -version
java version "17.0.13" 2024-10-15 LTS
Java(TM) SE Runtime Environment Oracle GraalVM 17.0.13+10.1 (build 17.0.13+10-LTS-jvmci-23.0-b49)
Java HotSpot(TM) 64-Bit Server VM Oracle GraalVM 17.0.13+10.1 (build 17.0.13+10-LTS-jvmci-23.0-b49, mixed mode, sharing)

I hope this information is helpful!

TharmiganK added the bug label Mar 13, 2024

fernando-valdez self-assigned this Mar 14, 2024

fernando-valdez changed the title ~~Cannot run SSL debug logs with GraalVM native image~~ [GR-52698] Cannot run SSL debug logs with GraalVM native image Mar 14, 2024

Bhashinee mentioned this issue Mar 20, 2024

SSL Handshake Debug Logs not Visible with Graalvm Native Image ballerina-platform/ballerina-library#6159

Closed

fernando-valdez closed this as completed Jan 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[GR-52698] Cannot run SSL debug logs with GraalVM native image #8564

[GR-52698] Cannot run SSL debug logs with GraalVM native image #8564

TharmiganK commented Mar 13, 2024 •

edited

Loading

fernando-valdez commented Mar 14, 2024

Uh oh!

fernando-valdez commented Mar 20, 2024

Uh oh!

TharmiganK commented Mar 21, 2024

Uh oh!

TharmiganK commented Mar 27, 2024

Uh oh!

aanavaneeth commented Apr 4, 2024

Uh oh!

TharmiganK commented Jun 11, 2024

Uh oh!

gingk1212 commented Jan 14, 2025

Uh oh!

[GR-52698] Cannot run SSL debug logs with GraalVM native image #8564

[GR-52698] Cannot run SSL debug logs with GraalVM native image #8564

Comments

TharmiganK commented Mar 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

fernando-valdez commented Mar 14, 2024

Uh oh!

fernando-valdez commented Mar 20, 2024

Uh oh!

TharmiganK commented Mar 21, 2024

Uh oh!

TharmiganK commented Mar 27, 2024

Uh oh!

aanavaneeth commented Apr 4, 2024

Uh oh!

TharmiganK commented Jun 11, 2024

Uh oh!

gingk1212 commented Jan 14, 2025

Uh oh!

TharmiganK commented Mar 13, 2024 •

edited

Loading