Geoserver3 in Tomcat 11 behind proxy won't connect to internet

LuukS · July 31, 2026, 2:59pm

We recently installed Geoserver 3_0_0 on a Linux RHEL 9.8. The server runs Tomcat 11.0.24 and Oracle JDK 17.0.19
We copied the data directory from geoserver 2.28. While testing we noticed that the layers that call an external WMS do not function. A preview of those layers gives an error:

Internal error Error while parsing XML.

Property 'http://javax.xml.XMLConstants/property/accessExternalSchema' is not recognized.

So we tried to add a WMS service by hand through the webinterface. We used the url

https ://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?request=GetCapabilities&service=wms

We are behind a proxy. So we set de base proxy url and we configured the JAVA_OPTS:

While searching on the error, we came across this possible JAVA_OPT setting: export JAVA_OPTS=“$JAVA_OPTS -Djavax.xml.accessExternalDTD=all”

But this does not help anything.

We also tried Tomcat11-Geoserver3 locally on a Windows laptop but this did not help either. If we add the WMS as a new source on this laptop, we get the error “Connection timed out: getsockopt” and in the log we find the following error:
[ows.wms] - Failed to execute request https: //service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.3.0&SERVICE=WMS

Any ideas what we should do to get this working?

jive · July 31, 2026, 5:00pm

Hello @LuukS thanks for joining us on Discourse.

I was responsible for reviewing a lot of the XML parsing for the GeoServer 3 release and did my best to review what is able to access what

The setting http://javax.xml.XMLConstants/property/accessExternalSchema is a list of where schemas can be loaded from jar, file, http` etc… and it is my understanding that it is available as a setting in the XML parser provided by Java.

But I have not tested with Oracle JDK and am very surprised if this setting is not available?!

Looking at this it appears that Oracle JDK parser does support this setting, but RHEL may be supplying a third-pary Xerces (the XML parser) library that does not support this property… huh not sure what we are supposed to do as an application if we cannot control the parser.

It looks like you can “restore” the built-in JDK parser by following some RHEL instructions. But you will need to look at if a third-party Xerces is being provided by RHEL.

Please report back on your experience, and we can update the user manual

The other thing to check is ENTITY_RESOLUTION_ALLOWLIST configuration. Please read the user manual section and experiment with:

ENTITY_RESOLUTION_ALLOWLIST=service.pdok.nl
ENTITY_RESOLUTION_ALLOWLIST=*
ENTITY_RESOLUTION_UNRESTRICTED_INTERNAL=true (not recommended at all but good test)

And please report back, I would love to understand if there is something wrong, or something we can make better note of in the update instructions.

GeoServer 2 Upgrade - has some notes on ENTITY_RESOLUTION_ALLOWLIST which you may of already followed?
GeoServer 3 Upgrade

LuukS · August 6, 2026, 6:45am

Hi Jody,

thanks for your reply and ideas. We tried them out but only partly succeeded. We can use an external WFS service now. So the proxy is being used.
But the WMS is still not working. I try it first on my Windows 11 machine with Tomcat 11 and openjdk 21.0.2 2024-01-16.
I tried using the setenv.bat file with the settings and also used Tomcat11w.exe to add the settings as Java Settings.

These are the settings I added:
-Dhttp.proxyHost=
-Dhttp.proxyPort=
-Dhttps.proxyHost=
-Dhttps.proxyPort=
-DENTITY_RESOLUTION_ALLOWLIST=*
-DENTITY_RESOLUTION_UNRESTRICTED_INTERNAL=true

Unfortunately it did not help, I will try OpenJDK Temurin 17 (LTS).

The log-file contains the following lines:
06 aug 08:27:40 DEBUG [org.geoserver] - Thread 112 got the lock in mode READ
06 aug 08:27:41 CONFIG [util.factory] - Factory implementations for category HTTPClientFactory:
org.geotools.http.DefaultHTTPClientFactory
org.geotools.http.commons.MultithreadedHttpClientFactory
06 aug 08:27:41 TRACE [geoserver.platform] - Found Property override : ‘ENTITY_RESOLUTION_UNRESTRICTED’ to be unset
06 aug 08:27:41 TRACE [geoserver.platform] - Found Java environment variable : ‘ENTITY_RESOLUTION_UNRESTRICTED’ to be unset
06 aug 08:27:41 TRACE [geoserver.platform] - Found Servlet context parameter : ‘ENTITY_RESOLUTION_UNRESTRICTED’ to be unset
06 aug 08:27:41 TRACE [geoserver.platform] - Found System environment variable : ‘ENTITY_RESOLUTION_UNRESTRICTED’ to be unset
06 aug 08:27:41 DEBUG [geotools.http] - URL is https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.3.0&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - Setting header User-Agent = GeoTools HTTPClient (35.0)
06 aug 08:27:41 DEBUG [geotools.xml] - Parser does not support ACCESS_EXTERNAL_DTD: Property ‘javax.xml.XMLConstants/property/accessExternalDTD’ is not recognized.
06 aug 08:27:41 DEBUG [ows.wms] - Failed to execute request https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.3.0&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - URL is https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.1.1&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - Setting header User-Agent = GeoTools HTTPClient (35.0)
06 aug 08:27:41 DEBUG [geotools.xml] - Parser does not support ACCESS_EXTERNAL_DTD: Property ‘javax.xml.XMLConstants/property/accessExternalDTD’ is not recognized.
06 aug 08:27:41 DEBUG [ows.wms] - Failed to execute request https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.1.1&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - URL is https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.1.0&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - Setting header User-Agent = GeoTools HTTPClient (35.0)
06 aug 08:27:41 DEBUG [geotools.xml] - Parser does not support ACCESS_EXTERNAL_DTD: Property ‘javax.xml.XMLConstants/property/accessExternalDTD’ is not recognized.
06 aug 08:27:41 DEBUG [ows.wms] - Failed to execute request https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?REQUEST=GetCapabilities&VERSION=1.1.0&SERVICE=WMS
06 aug 08:27:41 DEBUG [geotools.http] - URL is https://service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?request=capabilities&wmtver=1.0.0&service=wms
06 aug 08:27:41 DEBUG [geotools.http] - Setting header User-Agent = GeoTools HTTPClient (35.0)
06 aug 08:27:42 DEBUG [geotools.xml] - Parser does not support ACCESS_EXTERNAL_DTD: Property ‘javax.xml.XMLConstants/property/accessExternalDTD’ is not recognized.
06 aug 08:27:42 DEBUG [ows.wms] - Failed to execute request https:/_/_service.pdok.nl/hwh/luchtfotorgb/wms/v1_0?request=capabilities&wmtver=1.0.0&service=wms
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Property override : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Java environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found Servlet context parameter : ‘wicket.configuration’ to be unset
06 aug 08:27:42 TRACE [geoserver.platform] - Found System environment variable : ‘wicket.configuration’ to be unset
06 aug 08:27:42 DEBUG [geoserver.filters] - Compressing output for mimetype: text/xml;charset=UTF-8
06 aug 08:27:42 DEBUG [org.geoserver] - Thread 112 locking in mode READ
06 aug 08:27:42 DEBUG [org.geoserver] - Thread 112 releasing the lock in mode READ

LuukS · August 6, 2026, 8:05am

I tried using the OpenJDK 17, but unfortunately I get the same errors for the WMS service. I tried a WMTS service and it gives the same error as the WMS service.

LuukS · August 6, 2026, 9:23am

We have solved the problem. It was the xercesImpl-2.12.2.jar file which was the reason for the misbehaviour. It comes with the printing-plugin (I downloaded the file geoserver-3.0.0-printing-plugin.zip).

If I rename the file, so it won’t be used by Geoserver, I can use a WMS service as the source for a service.

jive · August 6, 2026, 5:30pm

Thanks @LuukS good troubleshooting, let’s make sure printing excludes xercesImpl.