SonarSource/sonarqube · error · IllegalStateException

Unexpected default trust managers:

Error message

Unexpected default trust managers:

What it means

The JVM's default TrustManagerFactory did not yield exactly one trust manager, or that manager was not an X509TrustManager. OkHttpClientBuilder requires a single X509TrustManager to build the HTTPS client, so it fails fast with IllegalStateException.

Source

Thrown at sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java:272

  private Response addHeaders(Interceptor.Chain chain) throws IOException {
    Request.Builder newRequest = chain.request().newBuilder();
    if (userAgent != null) {
      newRequest.header("User-Agent", userAgent);
    }
    if (credentials != null) {
      newRequest.header("Authorization", credentials);
    }
    return chain.proceed(newRequest.build());
  }

  private static X509TrustManager systemDefaultTrustManager() {
    try {
      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
      trustManagerFactory.init((KeyStore) null);
      TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
        throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
      }
      return (X509TrustManager) trustManagers[0];
    } catch (GeneralSecurityException e) {
      // The system has no TLS. Just give up.
      throw new AssertionError(e);
    }
  }

  private static SSLSocketFactory systemDefaultSslSocketFactory(X509TrustManager trustManager) {
    KeyManager[] defaultKeyManager;
    try {
      defaultKeyManager = getDefaultKeyManager();
    } catch (Exception e) {
      throw new IllegalStateException("Unable to get default key manager", e);
    }
    try {
      SSLContext sslContext = SSLContext.getInstance("TLS");
      sslContext.init(defaultKeyManager, new TrustManager[] {trustManager}, null);

View on GitHub (pinned to 184c821202)

Solutions

1. Inspect TrustManagerFactory.getDefaultAlgorithm() and the trust managers it returns on the affected JVM
2. Remove or fix custom 'ssl.TrustManagerFactory.algorithm' settings in java.security or provider overrides
3. Ensure the default KeyStore (javax.net.ssl.trustStore) is readable and valid
4. Explicitly configure the builder with your own trust manager/SSL socket factory instead of relying on system defaults

Example fix

// before
OkHttpClient client = new OkHttpClientBuilder().build(); // JVM default trust store broken
// after
X509TrustManager tm = loadCustomTrustManager("/path/truststore.jks", "changeit");
OkHttpClient client = new OkHttpClientBuilder().setTrustManager(tm).build();

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null);
TrustManager[] tms = tmf.getTrustManagers();
if (tms.length != 1 || !(tms[0] instanceof X509TrustManager)) {
  throw new IllegalStateException("JVM default trust store unusable: " + Arrays.toString(tms));
}

try {
  OkHttpClient client = new OkHttpClientBuilder().build();
} catch (IllegalStateException e) {
  if (e.getMessage().contains("Unexpected default trust managers")) {
    // fall back to explicitly configured trust manager
  }
}

When it happens

Trigger: Calling OkHttpClientBuilder.build() (via trustManager/systemDefaultTrustManager) on a JVM whose default trust store resolves to zero, multiple, or non-X509 trust managers — typically when the 'ssl.TrustManagerFactory.algorithm' security property or javax.net.ssl setup is customized.

Common situations: Custom java.security configurations, exotic JDKs or FIPS/security providers overriding the default trust algorithm, or embedded JVMs with no system CA store.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Unable to get default key manager
• Failed to setup SSL context on ES client
• Unable to configure: . File specified in [] does not exist
• Unable to configure: . Could not get read access to []
• Failed to setup SSL context on ES client

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e62af94fc801021b. Report an issue: GitHub.