Debugging SSL handshake errors connecting to WireMock

Question

I'm getting cryptic SSL handshake errors when I attempt to connect to WireMock - error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177: WireMock standalone is running with --https-keystore pointing to a cert I've verified using keytool. Regular HTTP mocks are working fine.

I turned on --print-all-network-traffic and when I call openssl s_client -connect 127.0.0.1:443 -showcerts -status -state -debug this is what I'm seeing:

2017-07-08 23:36:55.881 Opened Socket[addr=/172.17.0.1,port=46404,localport=443]
2017-07-08 23:36:55.886 Problem decoding network traffic
java.nio.charset.MalformedInputException: Input length = 1
    at java.nio.charset.CoderResult.throwException(CoderResult.java:281)
    at java.nio.charset.CharsetDecoder.decode(CharsetDecoder.java:816)
    at com.github.tomakehurst.wiremock.http.trafficlistener.ConsoleNotifyingWiremockNetworkTrafficListener.incoming(ConsoleNotifyingWiremockNetworkTrafficListener.java:25)
    at com.github.tomakehurst.wiremock.jetty9.JettyHttpServer$NetworkTrafficListenerAdapter.incoming(JettyHttpServer.java:364)
    at org.eclipse.jetty.io.NetworkTrafficSelectChannelEndPoint.notifyIncoming(NetworkTrafficSelectChannelEndPoint.java:125)
    at org.eclipse.jetty.io.NetworkTrafficSelectChannelEndPoint.fill(NetworkTrafficSelectChannelEndPoint.java:48)
    at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:507)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:239)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:748)
2017-07-08 23:36:55.895 Closed Socket[addr=/172.17.0.1,port=46404,localport=443]
2017-07-08 23:36:55.896 Closed Socket[addr=/172.17.0.1,port=46404,localport=443]

Any ideas on where to go from here?

Answer 1

That's what it looks like when you only give a public cert.