__admin/certs/wiremock-ca.crt returns 500 after 3.13.2 image was republished on March 11, 2026

[metalix2]

Description

The wiremock/wiremock:3.13.2 Docker image was republished on March 11, 2026, and the updated image has a regression where the __admin/certs/wiremock-ca.crt endpoint returns a 500 even when --enable-browser-proxying is enabled.

The error from WireMock is:

Failed to export certificate authority cert from /root/.wiremock/ca-keystore.jks

The previous build of this tag (3.13.2-2) works correctly.

Image digests

Tag	Created	Digest	CA cert endpoint
3.13.2 (current)	2026-03-11	sha256:fd27e46090916e85326229e5102ee169ae729059f3374549615bd20a35fee1f2	500
3.13.2-2	2026-01-14	sha256:27c4b74404f58ceedc6899f73abdfe228d8f80d5efa4d8bd42d6c155558b677c	200

Reproduction steps

1. Pull the latest 3.13.2 image:

   docker pull wiremock/wiremock:3.13.2

2. Start a container with browser proxying enabled:

   docker run -d --name wiremock-ca-test -p 8080:8080 \
     -e WIREMOCK_OPTIONS="--enable-browser-proxying --preserve-host-header --global-response-templating" \
     wiremock/wiremock:3.13.2

3. Wait for startup, then request the CA cert:

   sleep 5
   curl -v http://localhost:8080/__admin/certs/wiremock-ca.crt

4. Actual result: HTTP 500 — Failed to export certificate authority cert from /root/.wiremock/ca-keystore.jks

5. Expected result: HTTP 200 with a valid PEM certificate

6. Clean up:

   docker stop wiremock-ca-test && docker rm wiremock-ca-test

Verify the previous build works

docker run -d --name wiremock-ca-test -p 8080:8080 \
  -e WIREMOCK_OPTIONS="--enable-browser-proxying --preserve-host-header --global-response-templating" \
  wiremock/wiremock:3.13.2-2

sleep 5
curl -v http://localhost:8080/__admin/certs/wiremock-ca.crt
# Returns 200 with valid certificate

docker stop wiremock-ca-test && docker rm wiremock-ca-test

Environment

• Docker Engine: 27.x (tested on macOS and Linux CI runners)
• Architecture: amd64

---

🤖 This issue was generated with Claude Code