Error connecting to a java process with TLSv1.3

--Apple-Mail=_4CB0BF43-2F52-41CF-A1AD-71703C5EB407
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hi,

I have a Jetty Java application server configured with SSL/TLS in which =
one of the versions it does is TLS v1.3.
It runs on Java 17 graalvm-ce-17.

This is the output of the version command on the curl I am using (MacOS =
X Tahoe, home-brew version)

dlsa@besta facialrecognition % /opt/homebrew/opt/curl/bin/curl -V
curl 8.18.0 (aarch64-apple-darwin25.2.0) libcurl/8.18.0 OpenSSL/3.6.1 =
zlib/1.2.12 brotli/1.2.0 zstd/1.5.7 AppleIDN libssh2/1.11.1 =
nghttp2/1.68.0 ngtcp2/1.20.0 nghttp3/1.15.0 mit-krb5/1.7-prerelease =
OpenLDAP/2.4.28/Apple
Release-Date: 2026-01-07
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs =
ipns ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet =
tftp ws wss
Features: alt-svc AppleSecTrust AsynchDNS brotli GSS-API HSTS HTTP2 =
HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL =
threadsafe TLS-SRP UnixSockets zstd

The command I run is :=20

dlsa@besta facialrecognition % /opt/homebrew/opt/curl/bin/curl =
--trace-ascii httpreq.log --tlsv1.3 --cacert =
jettyhttpscerts/jettyhttpscertbundle.pem =
'https://localhost:9433/auth/authorize'
curl: (35) TLS connect error: error:0A000126:SSL routines::unexpected =
eof while reading

The contents of the call=E2=80=99s log file is attached.

In the log file there is the last bit that is sent before the disconnect =
:

=3D> Send SSL data, 5 bytes (0x5)
0000: .....
* TLSv1.3 (OUT), TLS alert, decode error (562):

Which I suspected that, because the java server has a certificate signed =
through a CA certificate that I generated,
Curl needs the option --cacert jettyhttpscerts/jettyhttpscertbundle.pem =
to tell it to use the certificate in the trust chain
That is coming from the server.

If not it will throw the decode error. That was what was happening also =
before I put the =E2=80=94caret option.
But with the option I get the same error.
So I am not sure if its related to the server certificate being =
generated by me.

Could anyone shed some light into this ?

Thanks,
Regards


--Apple-Mail=_4CB0BF43-2F52-41CF-A1AD-71703C5EB407
Content-Disposition: attachment;
	filename=httpreq.log
Content-Type: application/octet-stream;
	x-unix-mode=0644;
	name="httpreq.log"
Content-Transfer-Encoding: 7bit

* Host localhost:9433 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:9433...
* ALPN: curl offers h2,http/1.1
=> Send SSL data, 5 bytes (0x5)
0000: .....
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
=> Send SSL data, 1480 bytes (0x5c8)
0000: .......z.....q..b.L}...CC..hG.....|..I ...#r[S..E...L...O.A..l..
0040: ...L..............u.........localhost...........................
0080: ........h2.http/1.1.........1.....*.(...........................
00c0: ..............+......-.....3..........D.0...&.$....H...*3i....P5
0100: !...J.I'....[..$-..s.U#..X.k.w.y..?D...............,j..T.T)-.7[.
0140: ..yy.#.`j..9...b.s.D.,....&.S...'...W%....X8v.{.......9M.g.e!..g
0180: .BO.6...,..8. .N....e<..8....K.'$ok...|...D*N.R..b..3Gv5.V'.....
01c0: .3.$I.S.=..qL ..G....v... -W|...$.6.....5........a.....y|..*.TS)
0200: ...7.:.....k....N..k..\..Z...p....4c....&.L...Us5.Y~).x..._l<0(.
0240: b'._.|..:+.?........a...$,.a....P..Z.G......u.....V.E.6.."j#.;.D
0280: ..w...R...e.b......H....`...)..n'.1.qT..d..T$P.= .A.'.....W...TX
02c0: .?+Z8...;k.....M......'...K:...]...Y8....Cg....X.U.'J.g....b6l..
0300: *+..J...Z.A.=.q.......;e.Ix..[...5.X..8C...C.......<...0..b9.x$,
0340: ........~L......!}.D.g...VV.....Nt............V.[..3.`.`.6H.r..S
0380: ...H..g..e.._..w.g.{...Q{5....L8+8..c...na...s.....h....C..8.-S{
03c0: ..*D!.".xT%C.y.s.{....E...n..I\E...J.<.i..$.........B...p.8.v.$/
0400: .Z...g.q...GIZ.LB.j..Y=..jB.w..&..R..:'H-e.N...@T.?....LB.W.Y...
0440: ..p.##...':...3....0..^............%..3"M...B5O.F...RI..HDT....:
0480: +...1E..2U....T.............Tk&.c.x#..4z..j.-.....fH.&.)tg.>....
04c0: ..?......E..).CJe...Q.x1@r.(..{..........`jZ3..>.j/..}'X..:..GD.
0500: .....q..xC.q:...&.N..>.._dy...D.E&7....+.G..5,....F..Hb.clR.l..P
0540: ... ....'g..........a......%..t......m.....%S....@.."bk.:....0..
0580: ...Tk1.F.D........f....f....#......1... Q$\[..5|bN.....L..?./..P
05c0: .....9.A
* SSL Trust Anchors:
*   CAfile: jettyhttpscerts/jettyhttpscertbundle.pem
<= Recv SSL data, 5 bytes (0x5)
0000: ....z
* TLSv1.3 (IN), TLS handshake, Server hello (2):
<= Recv SSL data, 122 bytes (0x7a)
0000: ...v...p....jI.^..g0,)......)..*.....K ...#r[S..E...L...O.A..l..
0040: ...L.........+.....3.$... .?...z.......i..Z2Q./dE....cT..T
=> Send SSL data, 5 bytes (0x5)
0000: .....
* TLSv1.3 (OUT), TLS alert, decode error (562):
=> Send SSL data, 2 bytes (0x2)
0000: .2
* TLS connect error: error:0A000126:SSL routines::unexpected eof while reading
* closing connection #0

--Apple-Mail=_4CB0BF43-2F52-41CF-A1AD-71703C5EB407
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii




--Apple-Mail=_4CB0BF43-2F52-41CF-A1AD-71703C5EB407
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html

--Apple-Mail=_4CB0BF43-2F52-41CF-A1AD-71703C5EB407--