mock-oauth2-server: [Docker] HTTPS configuration not working

Dear supporters, I am experiencing issues in setting up HTTPS configuration in docker mode for the latest release 0.5.6.

First try: keystore generated on its own

I have create a docker compose with

version: "3.1"

services:
  mock-oauth2-server:
    image: ghcr.io/navikt/mock-oauth2-server:0.5.6
    ports:
      - "36105:36105"
    volumes:
      - ./mock-oauth2-server/config.json:/app/config.json
    environment:
      SERVER_PORT: 36105
      JSON_CONFIG_PATH: /app/config.json
    hostname: host.docker.internal

where the config file is:

{
  "httpServer" : {
    "type" : "NettyWrapper",
    "ssl" : {}
  }
}

When starting the container, I can see in the logs:

io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: ...
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
2022-12-02T13:51:33.354171305Z 	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:489)
2022-12-02T13:51:33.354175697Z 	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:280)
2022-12-02T13:51:33.354179658Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
2022-12-02T13:51:33.354182839Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2022-12-02T13:51:33.354185629Z 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
2022-12-02T13:51:33.354188436Z 	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
2022-12-02T13:51:33.354191187Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
2022-12-02T13:51:33.354193904Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2022-12-02T13:51:33.354196605Z 	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
2022-12-02T13:51:33.354199250Z 	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
2022-12-02T13:51:33.354213707Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)
2022-12-02T13:51:33.354224269Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724)
2022-12-02T13:51:33.354228617Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650)
2022-12-02T13:51:33.354231520Z 	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
2022-12-02T13:51:33.354234216Z 	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
2022-12-02T13:51:33.354236900Z 	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
2022-12-02T13:51:33.354239571Z 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
2022-12-02T13:51:33.354242309Z 	at java.base/java.lang.Thread.run(Thread.java:829)
2022-12-02T13:51:33.354249255Z Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
2022-12-02T13:51:33.354252444Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
2022-12-02T13:51:33.354254984Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
2022-12-02T13:51:33.354257675Z 	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:340)
2022-12-02T13:51:33.354260346Z 	at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
2022-12-02T13:51:33.354262873Z 	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:186)
2022-12-02T13:51:33.354265494Z 	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
2022-12-02T13:51:33.354268033Z 	at java.base/sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:681)
2022-12-02T13:51:33.354270705Z 	at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:636)
2022-12-02T13:51:33.354273346Z 	at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:454)
2022-12-02T13:51:33.354276027Z 	at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:433)
2022-12-02T13:51:33.354278718Z 	at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:637)
2022-12-02T13:51:33.354281409Z 	at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:296)
2022-12-02T13:51:33.354284006Z 	at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1343)
2022-12-02T13:51:33.354286590Z 	at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1236)
2022-12-02T13:51:33.354289286Z 	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1285)
2022-12-02T13:51:33.354291829Z 	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:519)
2022-12-02T13:51:33.354294435Z 	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:458)

and, when testing the token creation with the debugger https://localhost:36105/default/debugger, I get the same as above in the logs plus the debugger stack trace

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:353)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:296)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:291)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1416)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
	at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:379)
	at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:337)
	at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:209)
	at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
	at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
	at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
	at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
	at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
	at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
	at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
	at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154)
	at no.nav.security.mock.oauth2.debugger.ClientKt.post(Client.kt:80)
	at no.nav.security.mock.oauth2.debugger.DebuggerRequestHandlerKt$debuggerCallback$1.invoke(DebuggerRequestHandler.kt:94)
	at no.nav.security.mock.oauth2.debugger.DebuggerRequestHandlerKt$debuggerCallback$1.invoke(DebuggerRequestHandler.kt:76)
	at no.nav.security.mock.oauth2.http.OAuth2HttpRouterKt$routeFromPathAndMethod$1.invoke(OAuth2HttpRouter.kt:161)
	at no.nav.security.mock.oauth2.http.OAuth2HttpRouterKt$routeFromPathAndMethod$1.invoke(OAuth2HttpRouter.kt:156)
	at no.nav.security.mock.oauth2.http.PathRouter.invokeWith(OAuth2HttpRouter.kt:117)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:96)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:86)
	at no.nav.security.mock.oauth2.debugger.DebuggerRequestHandler.invoke(DebuggerRequestHandler.kt)
	at no.nav.security.mock.oauth2.debugger.DebuggerRequestHandler.invoke(DebuggerRequestHandler.kt:27)
	at no.nav.security.mock.oauth2.http.PathRouter.invokeWith(OAuth2HttpRouter.kt:111)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:96)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:86)
	at no.nav.security.mock.oauth2.http.PathRouter.invokeWith(OAuth2HttpRouter.kt:117)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:96)
	at no.nav.security.mock.oauth2.http.PathRouter.invoke(OAuth2HttpRouter.kt:86)
	at no.nav.security.mock.oauth2.http.NettyWrapper$RouterChannelHandler.channelRead0(OAuth2HttpServer.kt:170)
	at no.nav.security.mock.oauth2.http.NettyWrapper$RouterChannelHandler.channelRead0(OAuth2HttpServer.kt:164)
	at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:99)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:93)
	at io.netty.handler.codec.http.HttpServerKeepAliveHandler.channelRead(HttpServerKeepAliveHandler.java:64)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
	at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:336)
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:308)
	at io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1373)
	at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1236)
	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1285)
	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:519)
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:458)
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:280)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724)
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650)
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1341)
	... 88 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
	... 94 more

Second try: provided keystore

In this case, the compose is:

services:
  mock-oauth2-server:
    image: ghcr.io/navikt/mock-oauth2-server:0.5.6
    ports:
      - "36105:36105"
    volumes:
      - ./mock-oauth2-server/config-cert-localhost.json:/app/config.json
      - ./mock-oauth2-server/localhost.p12:/app/localhost.p12
    environment:
      SERVER_PORT: 36105
      JSON_CONFIG_PATH: /app/config.json
    hostname: host.docker.internal

where localhost.p12 is the certificate file you are using in your tests (sorry, I am lazy) and the config is

{
  "httpServer" : {
    "type" : "NettyWrapper",
    "ssl" : {
      "keyPassword" : "",
      "keystoreFile" : "/app/localhost.p12",
      "keystoreType" : "PKCS12",
      "keystorePassword" : ""
    }
  }
}

When starting the container, I can see in the logs the same stack trace, but the first line:

io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
2022-12-02T14:08:53.385064682Z 	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:489)
2022-12-02T14:08:53.385072157Z 	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:280)
2022-12-02T14:08:53.385075563Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
2022-12-02T14:08:53.385078635Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2022-12-02T14:08:53.385081769Z 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
2022-12-02T14:08:53.385084790Z 	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
2022-12-02T14:08:53.385088193Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
2022-12-02T14:08:53.385091314Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2022-12-02T14:08:53.385094391Z 	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
2022-12-02T14:08:53.385097413Z 	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
2022-12-02T14:08:53.385100312Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)
2022-12-02T14:08:53.385105088Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724)
2022-12-02T14:08:53.385117568Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650)
2022-12-02T14:08:53.385120592Z 	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
2022-12-02T14:08:53.385123570Z 	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
2022-12-02T14:08:53.385126974Z 	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
2022-12-02T14:08:53.385143486Z 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
2022-12-02T14:08:53.385146481Z 	at java.base/java.lang.Thread.run(Thread.java:829)
2022-12-02T14:08:53.385151297Z Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
2022-12-02T14:08:53.385154177Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
2022-12-02T14:08:53.385156861Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
2022-12-02T14:08:53.385170446Z 	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:340)
2022-12-02T14:08:53.385173697Z 	at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
2022-12-02T14:08:53.385176476Z 	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:186)
2022-12-02T14:08:53.385179632Z 	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
2022-12-02T14:08:53.385182526Z 	at java.base/sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:681)
2022-12-02T14:08:53.385185148Z 	at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:636)
2022-12-02T14:08:53.385187773Z 	at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:454)
2022-12-02T14:08:53.385190276Z 	at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:433)
2022-12-02T14:08:53.385192853Z 	at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:637)

When asking a token using the debugger, I get the same stack trace as before.

Am I doing something wrong?

Thanks in advance