What causes "Unable to configure: . Could not get read access to []" in SonarSource/sonarqube?

chown/chmod the file so the SonarQube process user can read it (e.g. chown sonar:sonar keystore.p12 && chmod 400 keystore.p12)

SonarSource/sonarqube · error · MessageException

Unable to configure: . Could not get read access to []

Error message

Unable to configure: . Could not get read access to []

What it means

getFileNameFromPathProperty also verifies read permission on the configured keystore/truststore file. If path.toFile().canRead() is false it throws this MessageException reporting that read access could not be obtained for the path.

Source

Thrown at server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java:156

      builder.put("xpack.security.autoconfiguration.enabled", Boolean.FALSE.toString());
      builder.put("xpack.security.enabled", Boolean.FALSE.toString());
    }
  }

  private String getFileNameFromPathProperty(ProcessProperties.Property processProperty) {
    String processPropertyPath = props.value(processProperty.getKey());

    if (processPropertyPath == null) {
      throw new MessageException(processProperty.getKey() + " property need to be set " +
        "when using elastic search authentication");
    }
    Path path = Paths.get(processPropertyPath);
    if (!path.toFile().exists()) {
      throw new MessageException("Unable to configure: " + processProperty.getKey() + ". "
        + "File specified in [" + processPropertyPath + "] does not exist");
    }
    if (!path.toFile().canRead()) {
      throw new MessageException("Unable to configure: " + processProperty.getKey() + ". "
        + "Could not get read access to [" + processPropertyPath + "]");
    }
    return path.getFileName().toString();
  }

  private void configureNetwork(Map<String, String> builder) {
    if (!clusterEnabled) {
      InetAddress searchHost = resolveAddress(SEARCH_HOST);
      int searchPort = Integer.parseInt(props.nonNullValue(SEARCH_PORT.getKey()));
      builder.put(ES_HTTP_HOST_KEY, searchHost.getHostAddress());
      builder.put(ES_HTTP_PORT_KEY, valueOf(searchPort));
      builder.put("discovery.type", "single-node");

      int transportPort = Integer.parseInt(props.nonNullValue(ES_PORT.getKey()));

      // we have no use of transport port in non-DCE editions
      // but specified host must be the one listed in: discovery.seed_hosts
      // otherwise elasticsearch cannot elect master node

View on GitHub (pinned to 184c821202)

Solutions

chown/chmod the file so the SonarQube process user can read it (e.g. chown sonar:sonar keystore.p12 && chmod 400 keystore.p12)
Grant traverse (x) permission on each parent directory of the file
Check SELinux/AppArmor policies and relabel/allow access if a MAC layer denies the read
Verify the file is a regular readable file, not a device or broken mount

Example fix

// before
-r-------- 1 root root 4134 keystore.p12
// after
chown sonar:sonar /etc/sonarqube/ssl/keystore.p12
chmod 400 /etc/sonarqube/ssl/keystore.p12

Defensive patterns

Strategy: validation

Validate before calling

File f = new File(props.get("sonar.cluster.es.ssl.keystore.path"));
if (f.isFile() && !f.canRead()) throw new IllegalStateException("Process user cannot read: " + f);

Try / catch

try { esSettings.build(); } catch (MessageException e) { log.error("ES store unreadable: {}", e.getMessage()); throw new ConfigurationException(e); }

Prevention

Run a pre-start check that reads each configured store file as the service user
Standardize ownership: chown sonar:sonar with mode 0400 for keystores
Ensure parent directories grant traverse (x) permission
Account for SELinux/AppArmor in hardened environments

When it happens

Trigger: The store file exists but the SonarQube process user lacks read permission on it (or on a parent directory), e.g. after copying files as root with restrictive modes.

Common situations: Certificates owned by root with 0600 while SonarQube runs as the 'sonar' user; parent directory lacking execute bit for the service account; SELinux/AppArmor blocking access.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/4e778d9556fdfe1c. Report an issue: GitHub.