"Error setting certificate chain" error on Centos 7 with openssl-static (boringssl-static is fine)

Using JVM 1.8.0_201 (Oracle), I'm seeing an OpenSSL initialization error in Centos 7.5.1804 with openssl-static, but it works fine in Ubuntu 18.04.2. Both distros work fine with boringssl-static.

What I'm doing

Setting up an SslContext within Netty, using OpenSSL (via tc-native) as the provider:

   private SslContext configureTls() throws Exception {
        final ApplicationProtocolConfig apn = new ApplicationProtocolConfig(
            Protocol.ALPN,
            // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.
            SelectorFailureBehavior.NO_ADVERTISE,
            // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.
            SelectedListenerFailureBehavior.ACCEPT,
            ApplicationProtocolNames.HTTP_2,
            ApplicationProtocolNames.HTTP_1_1);

        final KeyManagerFactory kmf = sslEngineFactory.newKeyManagerFactory();

        return SslContextBuilder.forServer(kmf)
            .sslProvider(SslProvider.OPENSSL)
            .ciphers(SslEngineFactory.supportedCiphers, SupportedCipherSuiteFilter.INSTANCE)
            .applicationProtocolConfig(apn).build();
    }

Due to needing certain TLS_DHE ciphers which aren't provided by boringssl, I have compiled openssl-static as per the wiki and ./mvnw -pl openssl-static clean package. I have compiled this in a Centos 7.5.1804 system such that the Fedora flags are true on build time.

This has been compiled against HEAD and also 2.0.25.Final (and the below error in seen for both versions).

The error

When my application starts up in Ubuntu, it works fine with the openssl-static JAR. However when starting up in Centos the logs show:

2019-05-16T10:33:49,254 DEBUG main KeyManagerFactory not supported.

And further debugging shows the stack as:

Error setting certificate chain (error:0200100D:system library:fopen:Permission denied)
io.netty.internal.tcnative.SSL.setCertificateChainBio(Native Method)
io.netty.handler.ssl.OpenSsl.(OpenSsl.java:200)
io.netty.handler.ssl.ReferenceCountedOpenSslContext.(ReferenceCountedOpenSslContext.java:204)
io.netty.handler.ssl.OpenSslContext.(OpenSslContext.java:43)
io.netty.handler.ssl.OpenSslServerContext.(OpenSslServerContext.java:345)
io.netty.handler.ssl.OpenSslServerContext.(OpenSslServerContext.java:333)
io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:423)
io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:447)

If I switch to use boringssl-static, it works fine on both Ubuntu and Centos (i.e. the KeyManagerFactory is supported and there are no errors on startup or system use).

Reproduce the startup failure on CentOS 7.5 with the openssl-static build described in the issue, then inspect io.netty.handler.ssl.OpenSsl at OpenSsl.java:200 and the native setCertificateChainBio call in the stack trace. Done means the OpenSSL provider initializes without the certificate-chain permission error while retaining the openssl-static configuration.