As initially reported on Discourse, proxying H2 TLS connections with the the linkerd:latest Docker image fails with the message "JDK provider does not support NPN_AND_ALPN protocol". This message appears to indicate that BoringSSL is not being used and Linkerd is falling back to the JDK-provided SSL implementation.

Curiously, this issue only seems to exist when the Docker image is run from a Linux host – I originally attempted to reproduce the issue on macOS and everything worked fine. After trying the same configuration on Linux in GCE, I was able to reproduce the issue.