SonarSource/sonarqube · error · IllegalStateException

Unable to get default key manager

Error message

Unable to get default key manager

What it means

IllegalStateException in OkHttpClientBuilder.systemDefaultSslSocketFactory: after initializing the JVM-default TrustManagerFactory, the code expects exactly one X509TrustManager; if the JRE's default trust manager setup is missing or unexpected (e.g. non-X509 managers, broken security provider configuration) the catch on GeneralSecurityException produces this failure while building the default SSL socket factory.

Source

Thrown at sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java:286

      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
      trustManagerFactory.init((KeyStore) null);
      TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
        throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
      }
      return (X509TrustManager) trustManagers[0];
    } catch (GeneralSecurityException e) {
      // The system has no TLS. Just give up.
      throw new AssertionError(e);
    }
  }

  private static SSLSocketFactory systemDefaultSslSocketFactory(X509TrustManager trustManager) {
    KeyManager[] defaultKeyManager;
    try {
      defaultKeyManager = getDefaultKeyManager();
    } catch (Exception e) {
      throw new IllegalStateException("Unable to get default key manager", e);
    }
    try {
      SSLContext sslContext = SSLContext.getInstance("TLS");
      sslContext.init(defaultKeyManager, new TrustManager[] {trustManager}, null);
      return sslContext.getSocketFactory();
    } catch (GeneralSecurityException e) {
      // The system has no TLS. Just give up.
      throw new AssertionError(e);
    }
  }

  private static void logDebug(String msg) {
    boolean debugEnabled = "all".equals(System.getProperty("javax.net.debug"));
    if (debugEnabled) {
      System.out.println(msg);
    }
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Check the javax.net.ssl.keyStore, keyStoreType, keyStoreProvider and keyStorePassword system properties point to a valid keystore
2. Verify the keystore file exists, is readable, and the password is correct
3. Remove bogus keystore system properties so JVM defaults are used
4. Provide your own key manager / SSL socket factory to the builder

Example fix

// before
java -Djavax.net.ssl.keyStore=/missing/keystore.jks -jar app.jar
// after
java -Djavax.net.ssl.keyStore=/etc/certs/client.p12 -Djavax.net.ssl.keyStorePassword=changeit -Djavax.net.ssl.keyStoreType=PKCS12 -jar app.jar

String ks = System.getProperty("javax.net.ssl.keyStore");
if (ks != null && !ks.isEmpty() && !java.nio.file.Files.isReadable(java.nio.file.Paths.get(ks))) {
  throw new IllegalStateException("javax.net.ssl.keyStore not readable: " + ks);
}

try {
  SSLSocketFactory f = OkHttpClientBuilder.systemDefaultSslSocketFactory(tm);
} catch (IllegalStateException e) {
  if (e.getMessage().equals("Unable to get default key manager")) {
    LOG.error("Check javax.net.ssl.keyStore* properties", e.getCause());
  }
}

When it happens

Trigger: Building the client via systemDefaultSslSocketFactory when system properties javax.net.ssl.keyStore/keyStoreType/keyStoreProvider point to a missing, unreadable, or corrupt keystore, or a bad provider.

Common situations: javax.net.ssl.keyStore pointing to a nonexistent or wrong-password file, malformed PKCS12 keystores, or missing security providers on stripped-down JVMs.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Failed to setup SSL context on ES client
• Failed to setup SSL context on ES client
• Unexpected default trust managers:
• if keyStoreType is
• Elasticsearch KeyStore tool exited with code:

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/f554446989daedb1. Report an issue: GitHub.