javax.net.ssl.SSLHandshakeException: Insufficient buffer remaining for AEAD cipher fragment (2). Needs to be more than tag size (16)

javax.net.ssl.SSLHandshakeException: Insufficient buffer remaining for AEAD cipher fragment (2). Needs to be more than tag size (16)
        at sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:324)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:262)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:130)
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1397)
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1305)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
        at sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:818)
        at sun.security.ssl.SSLSocketImpl.access$200(SSLSocketImpl.java:73)
        at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:909)
        at arc.dqV.a(SourceFile:80)
        at arc.dqV.read(SourceFile:56)
        at arc.ud.a(SourceFile:187)
        at arc.ud.a(SourceFile:256)
        at arc.mf.modules.dicom.DicomNetworkService.readNextMessage(SourceFile:250)
        at arc.cQg.run(SourceFile:303)
        at arc.cQh.doExecute(SourceFile:497)
        at arc.utils.Task.a(SourceFile:990)
        at arc.utils.Task.run(SourceFile:939)
        at arc.dFf.a(SourceFile:530)
        at arc.dFf.run(SourceFile:478)
        at arc.dFe.run(SourceFile:321)
Caused by: javax.crypto.BadPaddingException: Insufficient buffer remaining for AEAD cipher fragment (2). Needs to be more than tag size (16)
        at sun.security.ssl.SSLCipher$T13GcmReadCipherGenerator$GcmReadCipher.decrypt(SSLCipher.java:1845)
        at sun.security.ssl.SSLSocketInputRecord.decodeInputRecord(SSLSocketInputRecord.java:262)
        at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:190)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:109)
        ... 18 more

Cause:
javax.crypto.BadPaddingException: Insufficient buffer remaining for AEAD cipher fragment (2). Needs to be more than tag size (16):
Stack:
javax.crypto.BadPaddingException: Insufficient buffer remaining for AEAD cipher fragment (2). Needs to be more than tag size (16)
        at sun.security.ssl.SSLCipher$T13GcmReadCipherGenerator$GcmReadCipher.decrypt(SSLCipher.java:1845)
        at sun.security.ssl.SSLSocketInputRecord.decodeInputRecord(SSLSocketInputRecord.java:262)
        at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:190)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:109)
        at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1397)
        at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1305)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
        at sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:818)
        at sun.security.ssl.SSLSocketImpl.access$200(SSLSocketImpl.java:73)
        at sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:909)
        at arc.dqV.a(SourceFile:80)
        at arc.dqV.read(SourceFile:56)
        at arc.ud.a(SourceFile:187)
        at arc.ud.a(SourceFile:256)
        at arc.mf.modules.dicom.DicomNetworkService.readNextMessage(SourceFile:250)
        at arc.cQg.run(SourceFile:303)
        at arc.cQh.doExecute(SourceFile:497)
        at arc.utils.Task.a(SourceFile:990)
        at arc.utils.Task.run(SourceFile:939)
        at arc.dFf.a(SourceFile:530)
        at arc.dFf.run(SourceFile:478)
        at arc.dFe.run(SourceFile:321)

Cause

This is known Oracle issue. For details, visit the following links:

• https://bugs.openjdk.java.net/browse/JDK-8221218
• https://support.oracle.com/knowledge/Middleware/2519569_1.html

Solution

There are two solutions for this issue:

• Add -DUseSunHttpHandler=true in the startup arguments.
• Identify on which cipher the handshake was negoitiated by enabling the JSSE debug and disable that cipher in the jre/lib/security/java.security file.

see also

• https://docs.microfocus.com/doc/UCMDB/2021.05/InsufficientBufferAEADcipher