I'm having some trouble with our servers, we run in a ubuntu 18.04 as VM from Vmware ESXI 6.5 with a pfSense firewall as another vm, we have multiple tomcat instances running with no problem.

In the last few days, out of nothing, the application with java stopped sending emails and returning "COULD NOT CONVERT SOCKET TO TLS". I tried to replicate in another vmware server of mine, hosted at home, with same estructure, but it had the same problem.

Someone told me it could be the cacerts from java. Tried to apply update-ca-certificates, and update-ca-certificates. In my home server, it worked, all emails sent with no problem, but when I applied this in my production vmware server (hosted by IBM bare metal) it didn't worked.

The most unusual, it happens with any smtp server (gmail, and others). We use all emails with TLS and port 587.

Any ideas to solve this kind of problem, or any workaround ?


  • There are a few possible answers here: stackoverflow.com/questions/16115453/… – raj May 3 at 19:11
  • Thanks for the tip, We had tried some things, this configurations included, but no success. What is weird, it's one server has solved with the update-ca-certs, and the production one didn't. – Ermian May 3 at 21:10
  • You are on the right track: by default JavaMail client requires a trusted TLS server certificate. Use keytool -list to check the contents of the cacerts file on the server: for GMail it should contain a certificate for i:OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign. Check also whether the server isn't using an alternative truststore (javax.ssl.truststore system property). – Piotr P. Karwasz May 4 at 5:07
  • 1
    @PiotrP.Karwasz actually, the java on version 201, do not allow connections with TLS 1.0 and 1.1, so I had to edit my java.security file to be able to solve the problem. Gmail still uses TLS 1.1 – Ermian May 4 at 23:17

The problem was with the last versions of Java.

I had installed openjdk 1.8.0_292, since _291, doesn't allow TLS 1.0 and 1.1, protocol that Gmail has by default until today.

So, to be able to solve my problem without install another versions of java, I had edited the file /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/java.security

And commented that part:

#jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
#DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
#include jdk.disabled.namedCurves

And add this part right after:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
include jdk.disabled.namedCurves1

As you can see, the java had explicity disabled some protocols, returning the COULD NOT CONVERT SOCKET TO TLS error. Hope this help others who may find that problem.

PS: This is not right at all, it just worked for me so we could work while find another alternative. Here in Brazil we use some smtp server the didn't upgrade to v1.3 yet.

  • 1
    What!? Please use TLv1.2 or TLSv1.3 instead of re-enabling these old protocol versions! – anx May 4 at 23:36
  • This is not something I can choose, Gmail stmp is not accepting v1.2 or v1.3 yet. It's expected they update that, but I cannot wait without using the smtp until they fix that. – Ermian May 5 at 10:49
  • How you come to the conclusion that Gail is not accepting the current and previous version? Gmail currently talks TLS 1.3 to me just fine. – anx May 5 at 17:18
  • I couldn't connect using 1.3, I asked for a support for the companie who integrates our system to the smtp of gmail, and he told we would not be able to connect. We also use another smtp here in Brazil called Locaweb, also still using 1.1, because they didn't updated their protocols yet. – Ermian May 6 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.