java.lang.NoClassDefFoundError for SupportedEllipticCurvesExtension

Hi, I use Google Cloud Datastore which based on google-http-java-client(If I’m not wrong) and it works fine in web application with tomcat-8.5.30-jdk8-alpine but doesn’t work with tomcat-9.0.27-jdk8-openjdk-slim with NoClassDefFoundError. Here is the similar problem https://stackoverflow.com/questions/49112316/java-lang-noclassdeffounderror-sun-security-ssl-supportedellipticcurvesextensio.

Environment details

• OS: Linux
• Java version: 8
• google-http-java-client version: 1.32.1

Steps to reproduce

1. Run application with OpenJDK8

Stacktrace

java.lang.NoClassDefFoundError: sun/security/ssl/SupportedEllipticCurvesExtension at sun.security.ssl.ClientHandshaker.getKickstartMessage(ClientHandshaker.java:1438) at sun.security.ssl.Handshaker.kickstart(Handshaker.java:1072) at sun.security.ssl.SSLSocketImpl.kickstartHandshake(SSLSocketImpl.java:1479) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1346) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1340) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1315) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:264) at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:113) at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:84) at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1011) at com.google.auth.oauth2.ServiceAccountCredentials.refreshAccessToken(ServiceAccountCredentials.java:399) at com.google.auth.oauth2.OAuth2Credentials.refresh(OAuth2Credentials.java:181) at com.google.auth.oauth2.OAuth2Credentials.getRequestMetadata(OAuth2Credentials.java:167) at com.google.auth.http.HttpCredentialsAdapter.initialize(HttpCredentialsAdapter.java:96) at com.google.cloud.http.HttpTransportOptions$1.initialize(HttpTransportOptions.java:159) at com.google.cloud.datastore.spi.v1.HttpDatastoreRpc$1.initialize(HttpDatastoreRpc.java:81) at com.google.datastore.v1.client.RemoteRpc.call(RemoteRpc.java:181) at com.google.datastore.v1.client.Datastore.beginTransaction(Datastore.java:79) at com.google.cloud.datastore.spi.v1.HttpDatastoreRpc.beginTransaction(HttpDatastoreRpc.java:143) at com.google.cloud.datastore.DatastoreImpl$5.call(DatastoreImpl.java:520) at com.google.cloud.datastore.DatastoreImpl$5.call(DatastoreImpl.java:516) at com.google.api.gax.retrying.DirectRetryingExecutor.submit(DirectRetryingExecutor.java:105) at com.google.cloud.RetryHelper.run(RetryHelper.java:76) at com.google.cloud.RetryHelper.runWithRetries(RetryHelper.java:50) at com.google.cloud.datastore.DatastoreImpl.beginTransaction(DatastoreImpl.java:515) at com.google.cloud.datastore.DatastoreImpl.requestTransactionId(DatastoreImpl.java:509) at com.google.cloud.datastore.TransactionImpl.<init>(TransactionImpl.java:67) at com.google.cloud.datastore.TransactionImpl.<init>(TransactionImpl.java:54) at com.google.cloud.datastore.DatastoreImpl.newTransaction(DatastoreImpl.java:73)

External references such as API reference guides used

I see request was issued from library https://mvnrepository.com/artifact/com.google.api.client/google-api-client-javanet with last version at Dec 2015.

Any additional information below

I need application compatible with tomcat 9 and OpenJDK. Please let me know how I can fix NoClassDefFoundError error. Thank you.

[a-pavlov]

@chanseokoh You are right, it was obsolete jetty-alpn-agent-2.0.6. Update to version 2.0.9 fixed problem. Thank you very much.

[chanseokoh]

I’m convinced this is not an issue in google-http-java-client. I suspect you are dynamically loading some bootstrap classes (e.g., using -Xbootclasspath/p) for some reason (either directly or indirectly) but loading an incompatible implementation.

For example, to enable HTTP/2 support on Java 8, many client and server implementations use the ALPN implementation provided by Jetty. (ALPN is a TLS (as known as SSL) extension.) In this case, since it modifies OpenJDK classes, one must choose the correct implementation version depending on OpenJDK versions.

The ALPN implementation, relying on modifications of OpenJDK classes, updates every time there are updates to the modified OpenJDK classes.

ref: https://www.eclipse.org/jetty/documentation/current/alpn-chapter.html#alpn-versions

Also see https://stackoverflow.com/a/41723534/1701388.

Note, I illustrated the Jetty ALPN just as an example. Another example is when using Grizzly to modify internal JDK classes to plug in the ALPN implementation. As such, it says “the ALPN implementation is sensitive to version of the Oracle JDK that’s being used.”

… required to include a special library on the JVM’s bootclasspath to override the default SSL/TLS handshake implementation … Because this requires modifying internal JDK classes, the ALPN implementation is sensitive to version of the Oracle JDK that’s being used. As such, the current Grizzly ALPN implementation requires JDK 1.8.0_(121,131,141). Later versions of JDK8 may work, but if the classes change in a significant way, it will result in a runtime issue.

ref: https://javaee.github.io/grizzly/http2.html

So, I think the most probably cause is that you (or someone in your stack) are indirectly modifying internal JDK classes, e.g., through -Xbootclasspath. It is likely that the TLS/SSL component has been modified. And loading an ALPN module is one of many cases of doing so. I don’t know anything about your environment, but check your stack and see if there is any component/product/module/server modifying the SSL implementation.