SSL Issues with OpenJDK

[evanH13]

We recently began experiencing issues when enrolling and using the Jamf binary to execute commands and run policies. Looking at the server logs, we're seeing a large amount of SSLHandshake errors specifically with VPP and what appears to be Jamf's Patch Management system. When running recon, we receive an "Unknown error", with no additional information. Based on our Jamf logs, it looks like the SSL issue is related to OpenJDK not having the correct certificates. Can Jamf please take a look at this Docker image and explore switching to another JDK?

To Reproduce
Steps to reproduce the behavior:

1. Containerize Jamf Pro using the Jamf Dockerfile
2. Enroll machines manually or via DEP
3. Use the binary to run recon or policy

Expected behavior
The binary should work as expected.

Additional context
Sample from Jamf log:
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[battlecow]

Just updated the image to 8.5.57 upstream Tomcat version, the ca-certificate package from the 8.5.51 tag is version 20190110 while the new tag is version 20200601~deb10u1.
Please give this new version a test and see if it resolves your certificate issue.

[evanH13]

@battlecow we actually were already using 8.5.57. I ended up using a Corretto base image, I had to modify the Dockerfile to accommodate the different flavor of Linux, but that resolved our issue. I can submit a PR if you'd like.

[battlecow]

That would be great, I just created the corretto branch so just target that one. Thanks!

[evanH13]

@battlecow Done! Let me know if you need anything else from me.

[battlecow]

LGTM, thanks for the PR. 👍

[ahousseini]

There is a bug in the debian package: https://bugs.debian.org/962596
See this related issue: docker-library/tomcat#208
This workaround should work for the moment:

RUN wget --no-check-certificate -c https://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.pem \
	&& mkdir /usr/local/share/ca-certificates/extra \
	&& mv GeoTrust_Global_CA.pem /usr/local/share/ca-certificates/extra/GeoTrust_Global_CA.crt \
	&& update-ca-certificates \
	&& rm -rf /usr/local/share/ca-certificates/extra