Issues with connecting jira-servicemanagement image to mysql5.7 database using ssl

[david]

I am working on a upgrade from jira-service-desk 4.13.1 to jira-service-management 4.17.1. 

Initially, we were using the cptactionhank's docker image (https://github.com/cptactionhank/docker-atlassian-jira-service-desk) in our kubernetes cluster, but we wanted to move to the official image during this upgrade.

However, we are having issues connecting to our mysql5.7 database using ssl. when using our dbconfig.xml the container reads out dbconfig.xml, tries to decrypt the password, doesn't perform the decryption and fails.

2021-07-21 16:11:44,602+0000 JIRA-Bootstrap INFO [c.a.j.config.database.SystemDatabaseConfigurationLoader] Reading database configuration from /var/atlassian/application-data/jira/dbconfig.xml
2021-07-21 16:11:44,628+0000 JIRA-Bootstrap INFO [c.a.j.config.database.DatabaseConfigHandler] Trying to get encrypted password from xml and decrypt it
2021-07-21 16:11:44,629+0000 JIRA-Bootstrap INFO [c.a.j.config.database.DatabaseConfigHandler] Database password decryption not performed.
2021-07-21 16:11:45,075+0000 JIRA-Bootstrap INFO [c.a.jira.startup.JiraStartupLogger] Running Jira startup checks.
2021-07-21 16:11:45,075+0000 JIRA-Bootstrap FATAL [c.a.jira.startup.JiraStartupLogger] Startup check failed. Jira will be locked.
2021-07-21 16:11:45,117+0000 JIRA-Bootstrap INFO [c.a.jira.startup.LauncherContextListener] Startup is complete. Jira is ready to serve.

 Here is our dbconfig.xml:

<?xml version="1.0" encoding="UTF-8"?>
<jira-database-config> 
<name>defaultDS</name> 
<delegator-name>default</delegator-name> 
<database-type>mysql57</database-type> 
<jdbc-datasource> 
<url>jdbc:mysql://address=(protocol=tcp)(host=<instance_url>)(port=<port>)(useSSL=true)(requireSSL=true)(verifyServerCertificate=true)(sslProtocol=TLSv1.2)(enabledTLSProtocols=TLSv1.2)/<database_name>?sessionVariables=default_storage_engine=InnoDB</url>
<driver-class>com.mysql.jdbc.Driver</driver-class> 
<username><user_name></username> 
<password><pass></password> 
<pool-min-size>30</pool-min-size> 
<pool-max-size>30</pool-max-size> 
<pool-max-wait>30000</pool-max-wait> 
<validation-query>select 1</validation-query> 
<min-evictable-idle-time-millis>60000</min-evictable-idle-time-millis> 
<time-between-eviction-runs-millis>300000</time-between-eviction-runs-millis> <pool-max-idle>30</pool-max-idle> 
<pool-remove-abandoned>true</pool-remove-abandoned> 
<pool-remove-abandoned-timeout>300</pool-remove-abandoned-timeout>
<pool-test-on-borrow>false</pool-test-on-borrow>
<pool-test-while-idle>true</pool-test-while-idle>
<validation-query-timeout>3</validation-query-timeout>
</jdbc-datasource>
</jira-database-config>

I've tested this xml with our current 4.13.1 cptactionhank image and an upgraded 4.17.1 cptactionhank image and they both work. I've also tried using this config with the 4.17.1-jdk8  and 4.17.1-jdk11 tags of the atlassian jira-servicemanagement image and they work if i set useSSL to false. Unfortunately we can't do that as we have security requirements that specify that we must use SSL 1.2.

Does anyone know why we seem to be unable to use ssl when connnecting on the atlassian docker images?