APM Java Agent - handshake failure connecting to APM server on Oracle JDK 1.8

APM Server version: 7.2.0

APM Agent language and version: Java (1.7.0)

**Description of the problem including expected versus actual behavior. **:
While setting up the Java APM Agent manually on Tomcat (-javaagent), the agent can not connect to the APM Server indicating a handshake_failure.

This behaviour is reproducable on Linux and Windows.

However, changing the underlying JDK from Oracle to OpenJDK immediatly solves this issue.

Steps to reproduce:

  1. Install Oracle JDK 1.8.0_144 or 1.8.0_152
  2. Instrument Apache Tomcat (9.0.22) with Elastic APM Agent ("-javaagent")
  3. Check Logs

Provide logs and/or server output (if relevant):
2019-07-15 10:52:27.215 [apm-server-healthcheck] DEBUG co.elastic.apm.agent.report.ApmServerHealthChecker - Starting healthcheck to https://XXX.XXX.XXX.XXX:9243/
2019-07-15 10:52:27.241 [main] DEBUG co.elastic.apm.agent.impl.payload.SystemInfo - container ID is null
2019-07-15 10:52:27.260 [main] INFO co.elastic.apm.agent.configuration.StartupInfo - Starting Elastic APM 1.7.0 as tomcat-application on Java 1.8.0_152 (Oracle Corporation) Linux 3.0.101-108.87-default
2019-07-15 10:52:27.261 [main] DEBUG co.elastic.apm.agent.configuration.StartupInfo - secret_token: 'XXXX' (source: Java System Properties)
2019-07-15 10:52:27.261 [main] DEBUG co.elastic.apm.agent.configuration.StartupInfo - server_urls: 'https://XXX.XXX.XXX.XXX:9243' (source: Java System Properties)
2019-07-15 10:52:27.261 [main] DEBUG co.elastic.apm.agent.configuration.StartupInfo - verify_server_cert: 'false' (source: Java System Properties)
2019-07-15 10:52:27.261 [main] DEBUG co.elastic.apm.agent.configuration.StartupInfo - application_packages: 'XX.XXX' (source: Java System Properties)
2019-07-15 10:52:27.261 [main] DEBUG co.elastic.apm.agent.configuration.StartupInfo - log_level: 'DEBUG' (source: Java System Properties)

2019-07-15 10:52:28.269 [apm-server-healthcheck] WARN co.elastic.apm.agent.report.ApmServerHealthChecker - Elastic APM server is not available (Received fatal alert: handshake_failure)

15-Jul-2019 10:52:28.924 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server version: Apache Tomcat/8.0.26
15-Jul-2019 10:52:28.925 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server built: Aug 18 2015 11:38:37 UTC
15-Jul-2019 10:52:28.925 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 8.0.26.0
15-Jul-2019 10:52:28.925 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Linux
15-Jul-2019 10:52:28.925 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 3.0.101-108.87-default
15-Jul-2019 10:52:28.926 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: amd64
15-Jul-2019 10:52:28.926 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /usr/java/jdk1.8.0_152/jre
15-Jul-2019 10:52:28.926 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0_152-b16
15-Jul-2019 10:52:28.926 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation
15-Jul-2019 10:52:28.926 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE: /opt/tomcat/apache-tomcat-8.0.26

2019-07-15 10:52:57.334 [apm-reporter] DEBUG co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Starting new request to https://XXX.XXX.XXX.XXX:9243/intake/v2/events
2019-07-15 10:52:57.338 [apm-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Failed to handle event of type METRICS with this error: Received fatal alert: handshake_failure
2019-07-15 10:52:57.338 [apm-reporter] DEBUG co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Event handling failure
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:2033)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1135)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:162)
at co.elastic.apm.agent.report.IntakeV2ReportingEventHandler.startRequest(IntakeV2ReportingEventHandler.java:242)
at co.elastic.apm.agent.report.IntakeV2ReportingEventHandler.handleEvent(IntakeV2ReportingEventHandler.java:168)
at co.elastic.apm.agent.report.IntakeV2ReportingEventHandler.onEvent(IntakeV2ReportingEventHandler.java:146)
at co.elastic.apm.agent.report.IntakeV2ReportingEventHandler.onEvent(IntakeV2ReportingEventHandler.java:64)
at co.elastic.apm.agent.shaded.lmax.disruptor.BatchEventProcessor.processEvents(BatchEventProcessor.java:168)
at co.elastic.apm.agent.shaded.lmax.disruptor.BatchEventProcessor.run(BatchEventProcessor.java:125)
at java.lang.Thread.run(Thread.java:748)
2019-07-15 10:52:57.338 [apm-reporter] INFO co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Backing off for 0 seconds (+/-10%)

My guess is that this version does not include the root SSL certificate used by the APM Server. Did you use a Let's Encrypt certificate by any chance?

Hi Felix,

no, I did not use "Let's Encrypt". The jdk was simply downloaded (at least the ones I tried on Windows).

However, there are a lot more subjectDNs included in the working coretto jdk compared to the not working oracle jdk.

Could you tell which root SSL certificate the APM Server is looking for?

The APM Server works with any certificate. The problem is that the JDK you are using apparently can't validate the certificate you have configured in the APM Server as it does not know about it. You can probably import the certificate into the JVM via keytool, though.

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.