We have a Openfire 4.8.3 server running after upgrading from 4.7.5 in February (our companies software vetting is a bit behind). Since 2 weeks our S2S connections have stopped working at random moments and the only way we can fix it is by restarting the server/service. It is running on a Windows Server 2016 machine with JDK17. The symptoms look similar to OF-3193, OF-3195, and/or OF-3201.
Are these bugs also present in version 4.8.3 or were these only introduced in the 5.x branch?
Hi! Sorry to hear about your troubles. In Openfire 4.8.0, we replaced the third-party networking library that was used in Openfire (with another third-party networking library). The issues that you mention are roughly related to that new library, but I wouldn’t go as far to say that they are a proven result of that migration. I have no data on when exactly those issues were introduced. It is not unlikely that the migration introduced them, but they may also have pre-existed, or have been introduced later.
Without more information and diagnostics, it’s not easy giving you a straight answer. At this point, we’re not even sure if what you’re experiencing is indeed the same as what’s documented in the tickets that you are referring to. Those tickets mostly relate to specific networking events (closing s2s connections). Can you correlate the problems with such events?
Are you in a position to reproduce the problem consistently? Can you do that in a lab-environment, and retry after upgrading such an environment to the latest release of Openfire?
Hello Guus, thank you for your response. It has been somewhat more stable since tweaking with the s2s encryption settings and enabling the closing of idle connections after 30 minutes. Now it happens in cycles of about a day and a half followed by 4 hours later and that repeats. Whenever the problem arrises all of our s2s connections stop working and are shown only as incoming, none of them are also outgoing/both until we restart the server/service and connections are set up again.
This is part of our openfire log around the times we experience the outages:
2026.07.07 12:20:42.569 e[33mWARN e[m [S2SOutgoingPromise-316]: org.jivesoftware.openfire.session.LocalOutgoingServerSession[Create outgoing session for: {local.server -> remote.server}] - An exception occurred while creating a session. Closing connection.
java.util.concurrent.TimeoutException: null
at java.util.concurrent.CompletableFuture.timedGet(CompletableFuture.java:1960) ~[?:?]
at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2095) ~[?:?]
at org.jivesoftware.openfire.session.LocalOutgoingServerSession.createOutgoingSession(LocalOutgoingServerSession.java:262) [xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.session.LocalOutgoingServerSession.authenticateDomain(LocalOutgoingServerSession.java:209) [xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.establishConnection(OutgoingSessionPromise.java:288) [xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.run(OutgoingSessionPromise.java:244) [xmppserver-4.8.3.jar:4.8.3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
at java.lang.Thread.run(Thread.java:842) [?:?]
2026.07.07 12:22:33.083 e[33mWARN e[m [nioEventLoopGroup-521-1]: org.jivesoftware.openfire.server.ServerDialback[Acting as Originating Server: Create Outgoing Session from: local.server to a RS in the domain of: remote.server (port: 5269)] - Unable to create a new outgoing session
2026.07.07 12:22:33.083 e[33mWARN e[m [nioEventLoopGroup-521-1]: org.jivesoftware.openfire.nio.NettyOutboundConnectionHandler - TLS negotiation with 'remote.server' was unsuccessful, and Server Dialback over a plain connection (as a fallback) failed. Aborting session.
2026.07.07 12:22:33.083 e[33mWARN e[m [nioEventLoopGroup-521-1]: org.jivesoftware.openfire.nio.NettyXMPPDecoder - Error occurred while decoding XMPP stanza, closing connection: NettyConnection{peer: remote.server/remoteIP:5269, state: CLOSED, session: null, Netty channel handler context name: NettyOutboundConnectionHandler#0}
io.netty.handler.codec.DecoderException: org.jivesoftware.openfire.nio.XMLNotWellFormedException: Character is invalid in:
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:289) [netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.handlerRemoved(ByteToMessageDecoder.java:266) [netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:537) [netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) [netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) [netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at java.lang.Thread.run(Thread.java:842) [?:?]
Caused by: org.jivesoftware.openfire.nio.XMLNotWellFormedException: Character is invalid in:
at org.jivesoftware.openfire.nio.XMLLightweightParser.read(XMLLightweightParser.java:205) ~[xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.nio.NettyXMPPDecoder.decode(NettyXMPPDecoder.java:59) ~[xmppserver-4.8.3.jar:4.8.3]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
... 28 more
2026.07.07 12:22:33.084 e[33mWARN e[m [nioEventLoopGroup-521-1]: org.jivesoftware.openfire.nio.NettyXMPPDecoder - Error occurred while decoding XMPP stanza, closing connection: NettyConnection{peer: remote.server/remoteIP:5269, state: CLOSED, session: null, Netty channel handler context name: NettyOutboundConnectionHandler#0}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathBuilderException: Unable to find certificate chain.
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at java.lang.Thread.run(Thread.java:842) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathBuilderException: Unable to find certificate chain.
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:383) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:326) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:321) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:481) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209) ~[?:?]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1651) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1497) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1338) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1387) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
... 17 more
Caused by: java.security.cert.CertificateException: java.security.cert.CertPathBuilderException: Unable to find certificate chain.
at org.jivesoftware.openfire.keystore.OpenfireX509TrustManager.checkServerTrusted(OpenfireX509TrustManager.java:123) ~[xmppserver-4.8.3.jar:4.8.3]
at io.netty.handler.ssl.util.X509TrustManagerWrapper.checkServerTrusted(X509TrustManagerWrapper.java:69) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:481) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209) ~[?:?]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1651) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1497) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1338) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1387) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
... 17 more
Caused by: java.security.cert.CertPathBuilderException: Unable to find certificate chain.
at org.bouncycastle.jce.provider.PKIXCertPathBuilderSpi_8.engineBuild(Unknown Source) ~[bcprov-jdk18on-1.78.1.jar:?]
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297) ~[?:?]
at org.jivesoftware.openfire.keystore.OpenfireX509TrustManager.checkChainTrusted(OpenfireX509TrustManager.java:276) ~[xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.keystore.OpenfireX509TrustManager.checkServerTrusted(OpenfireX509TrustManager.java:119) ~[xmppserver-4.8.3.jar:4.8.3]
at io.netty.handler.ssl.util.X509TrustManagerWrapper.checkServerTrusted(X509TrustManagerWrapper.java:69) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:481) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264) ~[?:?]
at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209) ~[?:?]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1651) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1497) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1338) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1387) ~[netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
... 17 more
2026.07.07 12:22:33.084 e[33mWARN e[m [nioEventLoopGroup-521-1]: org.jivesoftware.openfire.nio.NettyXMPPDecoder - Error occurred while decoding XMPP stanza, closing connection: NettyConnection{peer: remote.server/remoteIP:5269, state: CLOSED, session: null, Netty channel handler context name: NettyOutboundConnectionHandler#0}
io.netty.handler.codec.DecoderException: java.lang.NullPointerException
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:427) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:394) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:377) ~[netty-codec-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:303) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.ChannelInboundHandlerAdapter.channelInactive(ChannelInboundHandlerAdapter.java:81) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.handler.timeout.IdleStateHandler.channelInactive(IdleStateHandler.java:280) [netty-handler-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:303) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:274) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1405) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:301) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:281) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:901) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.AbstractChannel$AbstractUnsafe$7.run(AbstractChannel.java:813) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:470) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566) [netty-transport-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-common-4.1.108.Final.jar:4.1.108.Final]
at java.lang.Thread.run(Thread.java:842) [?:?]
Caused by: java.lang.NullPointerException
2026.07.07 12:22:33.085 e[33mWARN e[m [S2SOutgoingPromise-316]: org.jivesoftware.openfire.session.LocalOutgoingServerSession[Authenticate local domain: 'local.server' to remote domain: 'remote.server'] - Unable to authenticate: Fail to create new session.
2026.07.07 12:22:33.085 e[33mWARN e[m [S2SOutgoingPromise-316]: org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor - An exception occurred while trying to establish a connection for {local.server -> remote.server}
java.lang.Exception: Failed to create connection to remote server
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.establishConnection(OutgoingSessionPromise.java:301) ~[xmppserver-4.8.3.jar:4.8.3]
at org.jivesoftware.openfire.server.OutgoingSessionPromise$PacketsProcessor.run(OutgoingSessionPromise.java:244) [xmppserver-4.8.3.jar:4.8.3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
at java.lang.Thread.run(Thread.java:842) [?:?]
Additionally, we sadly wont be able to reproduce the issues in a test environment since our test environment is not allowed to communicate with the same servers as our production environment. As for an upgrade, our organization has strict software screening policies which havent passed the latest version yet.
Thanks for the additional logs, those help identify some helpful parts.. Let me split this into what I can say with some confidence and what remains guesswork.
First, a couple of things in the log that are almost certainly not the cause of your outages, but are worth fixing regardless:
The SSLHandshakeException: CertPathBuilderException: Unable to find certificate chain is a trust issue with that specific remote peer. Openfire can’t build a valid chain to validate its certificate. That would fail consistently for that peer rather than cycling, so I don’t think it’s driving the reboots, but it’s worth sorting out on its own (check whether that remote’s chain/intermediates are complete and whether your trust store expects to validate it via the CA chain or via dialback). This is likely to fix connectivity issues, or at the very least reduce noise in the logs
The XMLNotWellFormedException: Character is invalid and the NullPointerException on channel close are, I’m fairly sure, downstream noise rather than root causes. When TLS fails and dialback falls back to a plain connection, Openfire ends up trying to parse whatever came back (often a TLS alert), which produces the malformed-XML error. I also suspect that generic port-scanning tools can cause log lines like these. The NullPointerException on channelInactive is a rough edge in the decoder path when a channel closes mid-handshake. These are likely symptoms of an abrupt close, but not the trigger.
On the actual issue: an interesting finding is the TimeoutException in createOutgoingSession. It seems that the outgoing half never completes, which matches your “everything shows as incoming only until restart” description. The tickets you referenced (OF-3193, OF-3201) were addressed on the 5.x line and were not backported to 4.8. I think OF-3193 fixes an issue that was introduced only later, but OF-3201 potentially is in 4.8.3. I can’t actually confirm from this log that those tickets are what you’re hitting. They relate to orphaned routes / packet loss on closed sessions, which is plausible but not proven from what we have.
Things that would actually move this from guesswork toward a diagnosis:
Watch whether the outgoing-session thread count (S2SOutgoingPromise-###) and the event-loop groups climb steadily across your ~1.5-day cycle. A thread dump taken while degraded, before the restart should show this. It’d show directly whether the event loops are blocked and on what.
Correlate the onset with connection/session counts in the admin console over the cycle.
Confirm whether the cert-chain failure is for one remote or many, and whether it only appears during the outage window or throughout.
Going deeper on live diagnostics for a release as old as 4.8.3 (which predates the relevant fixes and which I can’t easily reproduce against) is more than I can take on as a volunteer here. The genuinely fixing move is an upgrade. I understand from your earlier note that your vetting process makes that hard; unfortunately that’s also the constraint no amount of forum diagnosis can work around.
If your organisation needs someone to dig into this hands-on on the current unsupported version, there are several commercial providers who offer paid Openfire support. The community keeps a list here: Ignite Realtime: Support - Professional Partners . In the interest of full disclosure, I’m affiliated with one of them (GoodBytes), so take that recommendation with that context in mind.