ADDITIONAL SYSTEM INFORMATION :
Arch Linux 5.2.9

openjdk version "12.0.2" 2019-07-16
OpenJDK Runtime Environment (build 12.0.2+10)
OpenJDK 64-Bit Server VM (build 12.0.2+10, mixed mode)


A DESCRIPTION OF THE PROBLEM :
Writing the bytes of a JPEG file to a socket that was created from an SSLContext results in an error.
On Firefox 69, this error is SSL_ERROR_RX_RECORD_TOO_LONG. On Chromium 76, the error is ERR_SSL_PROTOCOL_ERROR.

The error does not occur with cURL 7.65.3: cURL downloads the image fine.

Here's a minimal server for reproducing the issue: https://gitlab.com/bullbytes/simple_socket_based_server

I've used Wireshark to look at the frames while the browsers are getting the image: Both Firefox and Chromium send a [FIN, ACK] frame to the server while the image is still being transmitted. The server continues sending parts of the image after which the browsers send a [RST] frame.

These are the last couple of frames from the exchange between Firefox and the server:

25 1.873102771 ::1 ::1 TCP 86 55444 → 8443 [ACK] Seq=937 Ack=18043 Win=56704 Len=0 TSval=3976879013 TSecr=3976879013
26 1.873237965 ::1 ::1 TLSv1.3 110 Application Data
27 1.873247272 ::1 ::1 TCP 86 8443 → 55444 [ACK] Seq=18043 Ack=961 Win=65536 Len=0 TSval=3976879013 TSecr=3976879013
28 1.873346910 ::1 ::1 TCP 86 55444 → 8443 [FIN, ACK] Seq=961 Ack=18043 Win=65536 Len=0 TSval=3976879013 TSecr=3976879013
29 1.876736432 ::1 ::1 TLSv1.3 16508 Application Data
30 1.876769660 ::1 ::1 TCP 74 55444 → 8443 [RST] Seq=962 Win=0 Len=0


Here's a corresponding question on Stack Overflow with a bounty on it: https://stackoverflow.com/questions/57679669/ssl-error-rx-record-too-long-with-custom-server


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
git clone git@gitlab.com:bullbytes/simple_socket_based_server.git
cd simple_socket_based_server
./gradlew run
firefox https://localhost:8443/ada.jpg


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
I expected to see the image in the browser.
ACTUAL -
SSL_ERROR_RX_RECORD_TOO_LONG in Firefox and ERR_SSL_PROTOCOL_ERROR in Chromium.

---------- BEGIN SOURCE ----------
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import java.io.*;
import java.net.InetSocketAddress;
import java.net.ServerSocket;
import java.net.URL;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.nio.file.Path;
import java.security.KeyStore;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Optional;

import static java.lang.String.format;

/**
 * Starts the server.
 * <p>
 * Person of contact: Matthias Braun
 */
public enum Start {
    ;

    // Used to read and write the socket's input and output stream
    private static Charset ENCODING = StandardCharsets.UTF_8;

    /**
     * Starts our server, ready to handle requests.
     *
     * @param args arguments are ignored
     */
    public static void main(String... args) {
        var address = new InetSocketAddress("0.0.0.0", 8443);

        boolean useTls = shouldUseTls(args);

        startServer(address, useTls);
    }

    private static boolean shouldUseTls(String[] args) {
        boolean useTls = true;

        for (String arg : args) {
            if (arg.equals("--use-tls=no")) {
                useTls = false;
                break;
            }
        }
        return useTls;
    }

    public static void startServer(InetSocketAddress address, boolean useTls) {

        String enabledOrDisabled = useTls ? "enabled" : "disabled";
        System.out.println(format("Starting server at %s with TLS %s", address, enabledOrDisabled));

        try (var serverSocket = useTls ?
                getSslSocket(address) :
                // Create a server socket without TLS
                new ServerSocket(address.getPort(), 0, address.getAddress())) {

            // This infinite loop is not CPU-intensive since method "accept" blocks
            // until a client has made a connection to the socket's port
            while (true) {
                try (var socket = serverSocket.accept();
                     // Read the client's request from the socket
                     var requestStream = new BufferedReader(new InputStreamReader(socket.getInputStream()));
                     // The server writes its response to the socket's output stream
                     var responseStream = new BufferedOutputStream(socket.getOutputStream())
                ) {
                    System.out.println("Accepted connection on " + socket);

                    String requestedResource = getRequestedResource(requestStream)
                            .orElse("unknown");

                    byte[] response = requestedResource.equals("/ada.jpg") ?
                            getJpgResponse(new URL("https://upload.wikimedia.org/wikipedia/commons/a/a4/Ada_Lovelace_portrait.jpg")) :
                            getTextResponse("The server says hi 👋", StatusCode.SUCCESS);

                    responseStream.write(response);

                    // It's important to flush the response stream before closing it to make sure any
                    // unsent bytes in the buffer are sent via the socket. Otherwise, the client gets an
                    // incomplete response
                    responseStream.flush();
                } catch (IOException e) {
                    System.err.println("Exception while handling connection");
                    e.printStackTrace();
                }
            }
        } catch (Exception e) {
            System.err.println("Could not create socket at " + address);
            e.printStackTrace();
        }
    }

    private static Optional<String> getRequestedResource(BufferedReader requestStream) {
        var lines = getHeaderLines(requestStream);

        return first(lines).map(statusLine -> {
            // Go past the space
            int beginIndex = statusLine.indexOf(' ') + 1;
            int endIndex = statusLine.lastIndexOf(' ');
            return statusLine.substring(beginIndex, endIndex);
        });
    }

    private static <E> Optional<E> first(List<E> list) {
        return (list != null && list.size() > 0) ?
                Optional.ofNullable(list.get(0)) :
                Optional.empty();
    }

    private static List<String> getHeaderLines(BufferedReader reader) {

        var headerLines = new ArrayList<String>();
        try {
            var line = reader.readLine();
            // The header is concluded when we see an empty line.
            // The line is null if the end of the stream was reached without reading
            // any characters. This can happen if the client tries to connect with
            // HTTPS while the server expects HTTP
            while (line != null && !line.isEmpty()) {
                headerLines.add(line);
                line = reader.readLine();
            }
        } catch (IOException e) {
            System.err.println("Could not read all lines from request");
            e.printStackTrace();
        }
        return headerLines;
    }

    private static ServerSocket getSslSocket(InetSocketAddress address)
            throws Exception {

        // Backlog is the maximum number of pending connections on the socket, 0 means an
        // implementation-specific default is used
        int backlog = 0;

        var keyStorePath = Path.of("./tls/keystore.jks");
        char[] keyStorePassword = "pass_for_self_signed_cert".toCharArray();

        // Bind the socket to the given port and address
        var serverSocket = getSslContext(keyStorePath, keyStorePassword)
                .getServerSocketFactory()
                .createServerSocket(address.getPort(), backlog, address.getAddress());

        // We don't need the password anymore → Overwrite it
        Arrays.fill(keyStorePassword, '0');

        return serverSocket;
    }

    private static SSLContext getSslContext(Path keyStorePath, char[] keyStorePassword)
            throws Exception {

        var keyStore = KeyStore.getInstance("JKS");
        keyStore.load(new FileInputStream(keyStorePath.toFile()), keyStorePassword);

        var keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
        keyManagerFactory.init(keyStore, keyStorePassword);

        var sslContext = SSLContext.getInstance("TLS");
        // Null means using default implementations for TrustManager and SecureRandom
        sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
        return sslContext;
    }

    private static byte[] concat(byte[] first, byte[] second) {
        // New array with contents of first one, having the length of the two input arrays combined
        byte[] result = Arrays.copyOf(first, first.length + second.length);
        // Copy the second array into the result array starting at the end of the first array
        System.arraycopy(second, 0, result, first.length, second.length);
        return result;
    }

    private static byte[] getJpgResponse(URL fileUrl) {

        byte[] response;
        try (var fileStream = fileUrl.openStream()) {
            var imageBytes = fileStream.readAllBytes();
            var fileName = new File(fileUrl.getPath()).getName();

            var statusLine = "HTTP/1.1 200 OK";
            var contentLength = "Content-Length: " + imageBytes.length;
            var contentType = "Content-Type: image/jpeg";
            var contentDisposition = format("Content-Disposition: inline; filename=%s", fileName);

            String header = statusLine + "\r\n" +
                    contentLength + "\r\n" +
                    contentType + "\r\n" +
                    contentDisposition + "\r\n" +
                    "\r\n";

            // Append the bytes of the image to the bytes of the header
            response = concat(header.getBytes(ENCODING), imageBytes);

        } catch (IOException e) {
            var msg = format("Could not read file at URL '%s'", fileUrl);
            System.err.println(msg);
            response = getTextResponse(msg, StatusCode.SERVER_ERROR);
        }
        return response;
    }

    private static byte[] getTextResponse(String text, StatusCode status) {
        var body = text + "\r\n";
        var contentLength = body.getBytes(ENCODING).length;
        var statusLine = format("HTTP/1.1 %s %s\r\n", status.code, status.text);

        var response = statusLine +
                format("Content-Length: %d\r\n", contentLength) +
                format("Content-Type: text/plain; charset=%s\r\n",
                        ENCODING.displayName()) +
                "\r\n" +
                body;

        return response.getBytes(ENCODING);
    }

    /**
     * HTTP status codes such as 200 and 404.
     * <p>
     * Person of contact: Matthias Braun
     */
    public enum StatusCode {
        SUCCESS(200, "Success"),
        SERVER_ERROR(500, "Internal Server Error");

        private final int code;
        private final String text;

        StatusCode(int code, String text) {
            this.text = text;
            this.code = code;
        }

        public int getCode() {
            return code;
        }

        public String getText() {
            return text;
        }

        /**
         * @return "200 Success" or "404 Not Found", for example
         */
        @Override
        public String toString() {
            return code + " " + text;
        }
    }
}

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
The described issue only occurs with TLS enabled. When starting the example server without TLS, the image is served just fine:

./gradlew run --args="--use-tls=no"
firefox http://localhost:8443/ada.jpg

Also, getting the image via TLS works when using cURL:
curl -Ok "https://localhost:8443/ada.jpg"

FREQUENCY : always