<p>Locally everything works!</p>

<p>However, after a deployment to my Kubernetes k3s cluster on raspberrypi, which is accessible via https domain the oauth2 code exchange for token feature doesn't work. I currently support authentication via Google and GitHub and both of them have this problem. Below are the logs:</p>

<p>GitHub login failure:</p>

<pre><code>org.springframework.security.oauth2.core.OAuth2AuthenticationException: 
[invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: Error while extracting response for type [class org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] and content type [application/json;charset=utf-8]; 
nested exception is org.springframework.http.converter.HttpMessageNotReadableException: An error occurred reading the OAuth 2.0 Access Token Response: tokenValue cannot be empty; 
nested exception is java.lang.IllegalArgumentException: tokenValue cannot be empty
</code></pre>

<p>Google login failure:</p>

<pre><code>org.springframework.security.oauth2.core.OAuth2AuthenticationException: 
[invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: I/O error on POST request for "https://www.googleapis.com/oauth2/v4/token": Invalid ECDH ServerKeyExchange signature; 
nested exception is javax.net.ssl.SSLHandshakeException: Invalid ECDH ServerKeyExchange signature
</code></pre>

<p>What I've already tried:</p>

<p>I thought it might be a problem with sending https requests from within my Kubernetes cluster, but I connected to the running pod and curled <a href="https://google.com" rel="nofollow noreferrer">https://google.com</a> and it worked just fine.</p>

<p>Have any of you guys encountered such a problem?</p>

<p>@edit
I'm using Java 11</p>

<p>@edit2
There seems to be a problem with docker on my raaspberrypi. Curling https requests work fine, but using <code>RestTemplate</code> in Java doesn't work</p>

<p>@edit3
Found a related issue <a href="https://github.com/docker-library/tomcat/issues/182" rel="nofollow noreferrer">https://github.com/docker-library/tomcat/issues/182</a></p>

Humberd
<p>Assuming you are using the exact same container/executable/libraries both locally and Kubernetes and based on the error messages that you shared, the most likely reason is different credentials and/or private keys between your local environment and your Kubernetes environment.</p>

<p>The errors look different for Github and Google though. The first error (GitHub) seems like you are sending an empty token.</p>

<p>The second error (Google) seems like you are sending an private key that doesn't match a certificate. Based <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/trb-security-sslhandshake.html" rel="nofollow noreferrer">on similar Java errors</a>:</p>

<blockquote>
  <p>The <code>Invalid ECDH ServerKeyExchange signature</code> can indicate that a key
  and a corresponding certificate don’t match and are causing the
  handshake to fail. Verify the contents of each of the files you are
  using for your configured certificate authorities, certificates and
  keys. In particular, check that the key and certificate belong to the
  same key pair.</p>
</blockquote>
