This is driving me nuts: I have a small modular JavaFX (TornadoFX) application running with Java 14. After a lot of headaches getting the module system to work (thanks to the Badass JLink Plugin (https://badass-jlink-plugin.beryx.org/releases/latest/)) I'm now trying to get a self-contained executable for it. The Plugin uses jpackager to generate the executable and it runs, but it won't use the (custom) trust manager for SSL connections.
I have small custom truststore file with some certificates. This gets loaded into a keystore on startup, which in turn is used to create a custom TrustManager instance. Both the custom TrustManager and the default one are then combined into a single TrustManager, who first tries to validate a certificate using the custom TrustManager and, if this fails, tries again with the default one.
This works fine when running the app from the IDE (gradle run). The application uses a WebView to show a remote login page and I can see in the logs that the TrustManager is used to validate the certificates. After this, a Rest call is made to some endpoint and again the trustmanager is invoked to check the certificates.
However, this does not work when I package the application using jpackager. Now, for some obscure reason, the trustmanager is only used for the connection made by the WebView and not for the Rest call.
I've compared the security permissions / policies for the packaged runtime and the one used in the IDE, no differences.
I'm really getting frustrated with Java. First the pain with the module system, now this. I have absolutely no clue what could be the problem.
Here are some logs. First the packaged version:
08:27:11.202 [INFO ] [JavaFX Application Thread] com.bmw.swhrl.dm.ui.view.LoginView - Location: https://somewebsite.org
08:27:11.400 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Chain
08:27:11.401 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:27:11.401 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:27:11.402 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Stored
08:27:11.402 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:27:11.403 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:27:11.403 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:27:11.450 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Accepted issuers
08:27:11.680 [INFO ] [JavaFX Application Thread] com.bmw.swhrl.dm.ui.view.LoginView - Location: http://localhost:8080/...
08:27:12.296 [INFO ] [tornadofx-thread-1] c.b.s.dm.ui.viewmodel.MainViewModel - Request: https://somewebsite/webapi/config
08:27:13.940 [INFO ] [tornadofx-thread-1] c.b.s.dm.ui.viewmodel.MainViewModel - Request: https://somewebsite/webapi/config
08:27:14.817 [INFO ] [tornadofx-thread-1] c.b.s.dm.ui.viewmodel.MainViewModel - Request: https://somewebsite/webapi/config
No calls to the trustmanager during the Rest call.
Now the version started from the IDE:
08:30:24.413 [INFO ] [JavaFX Application Thread] com.bmw.swhrl.dm.ui.view.LoginView - Location: https://somewebsite.org
08:30:24.582 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Chain
08:30:24.583 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:30:24.583 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:30:24.584 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Stored
08:30:24.585 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:30:24.586 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:30:24.643 [INFO ] [URL-Loader-1] com.bmw.swhrl.dm.util.TrustManager - Accepted issuers
08:30:24.936 [INFO ] [JavaFX Application Thread] com.bmw.swhrl.dm.ui.view.LoginView - Location: http://localhost:8080/...
08:30:25.610 [INFO ] [tornadofx-thread-1] c.b.s.dm.ui.viewmodel.MainViewModel - Request: https://somewebsite/webapi/config
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - Chain
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - CN=<cert>
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - Stored
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:30:25.731 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - CN=<stored cert>
08:30:25.732 [INFO ] [tornadofx-thread-1] com.bmw.swhrl.dm.util.TrustManager - Accepted issuers
Here the trustmanager is also called for the Rest call and the connection is made.
EDIT: I've now tried to compare the packaged runtime with the one installed on my system and I've found out that if I copy the file C:\Program Files\Java\jdk-14\lib\modules to the packaged runtimes lib\ folder it's working. Still this does not help much as I do not know where this modules file comes from and why the one shipped with the packaged runtime is larger than the one found in my system wide installation, but maybe someone has an idea.