__admin/certs/wiremock-ca.crt returns 500 after 3.13.2 image was republished on March 11, 2026

Description

The wiremock/wiremock:3.13.2 Docker image was republished on March 11, 2026, and the updated image has a regression where the __admin/certs/wiremock-ca.crt endpoint returns a 500 even when --enable-browser-proxying is enabled.

The error from WireMock is:

Failed to export certificate authority cert from /root/.wiremock/ca-keystore.jks

The previous build of this tag (3.13.2-2) works correctly.

Image digests

Reproduction steps

1. Pull the latest 3.13.2 image:

   docker pull wiremock/wiremock:3.13.2
   

2. Start a container with browser proxying enabled:

   docker run -d --name wiremock-ca-test -p 8080:8080 \
     -e WIREMOCK_OPTIONS="--enable-browser-proxying --preserve-host-header --global-response-templating" \
     wiremock/wiremock:3.13.2
   

3. Wait for startup, then request the CA cert:

   sleep 5
   curl -v http://localhost:8080/__admin/certs/wiremock-ca.crt
   

4. Actual result: HTTP 500 — Failed to export certificate authority cert from /root/.wiremock/ca-keystore.jks

5. Expected result: HTTP 200 with a valid PEM certificate

6. Clean up:

   docker stop wiremock-ca-test && docker rm wiremock-ca-test
   

Verify the previous build works

docker run -d --name wiremock-ca-test -p 8080:8080 \
  -e WIREMOCK_OPTIONS="--enable-browser-proxying --preserve-host-header --global-response-templating" \
  wiremock/wiremock:3.13.2-2

sleep 5
curl -v http://localhost:8080/__admin/certs/wiremock-ca.crt
# Returns 200 with valid certificate

docker stop wiremock-ca-test && docker rm wiremock-ca-test

Environment

• Docker Engine: 27.x (tested on macOS and Linux CI runners)
• Architecture: amd64

🤖 This issue was generated with Claude Code

Reproduce the failure with the documented docker pull, docker run, and curl commands for wiremock/wiremock:3.13.2, then compare it with 3.13.2-2 and their listed digests. Investigate the image or build difference responsible for the CA export failure; done means __admin/certs/wiremock-ca.crt returns HTTP 200 with a valid PEM certificate when browser proxying is enabled.