apache/seatunnel · error · IllegalArgumentException

AmazonDocumentDB TLS CA bundle contains no certificates:

Error message

AmazonDocumentDB TLS CA bundle contains no certificates: 

What it means

createSslContext loads the TLS CA bundle with CertificateFactory.generateCertificates and throws IllegalArgumentException if the parsed collection is empty. It means the file exists and is readable but contains no X.509 certificates. The trust store would otherwise be empty, causing silent TLS handshake failures later.

Source

Thrown at seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java:215

        try {
            BsonDocument.parse(value);
        } catch (RuntimeException e) {
            throw new IllegalArgumentException(
                    "AmazonDocumentDB option '"
                            + optionName
                            + "' must be a valid BSON/JSON document",
                    e);
        }
    }

    /** Builds an isolated trust context from every X.509 certificate in the supplied CA bundle. */
    private static SSLContext createSslContext(Path caBundlePath) {
        try (InputStream inputStream = Files.newInputStream(caBundlePath)) {
            CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
            Collection<? extends Certificate> certificates =
                    certificateFactory.generateCertificates(inputStream);
            if (certificates.isEmpty()) {
                throw new IllegalArgumentException(
                        "AmazonDocumentDB TLS CA bundle contains no certificates: " + caBundlePath);
            }

            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            trustStore.load(null, null);
            int certificateIndex = 0;
            for (Certificate certificate : certificates) {
                trustStore.setCertificateEntry(
                        "amazondocumentdb-ca-" + certificateIndex, certificate);
                certificateIndex++;
            }

            TrustManagerFactory trustManagerFactory =
                    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(trustStore);
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, trustManagerFactory.getTrustManagers(), null);
            return sslContext;

View on GitHub (pinned to cf67b549a7)

Solutions

1. Re-download the official bundle: `wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`.
2. Check the file begins with `-----BEGIN CERTIFICATE-----` and has nonzero size (`grep -c BEGIN CERTIFICATE file`).
3. If a URL was configured, note tls_ca_file needs a local path, not an http:// URL.

Example fix

// before
tls_ca_file = "/opt/certs/bundle.pem"  // 0-byte truncated download
// after
tls_ca_file = "/opt/certs/global-bundle.pem"  // verified: 40+ CERTIFICATE blocks

Path p = Paths.get(caBundle);
byte[] bytes = Files.readAllBytes(p);
if (bytes.length == 0 || new String(bytes, StandardCharsets.ISO_8859_1).indexOf("BEGIN CERTIFICATE") < 0) {
    throw new IllegalArgumentException("CA bundle contains no certificates: " + p);
}

When it happens

Trigger: tls_ca_file points to a file with no PEM/DER certificates: an empty file, an HTML error page saved as .pem, a truncated download, or a text file containing only the bundle URL.

Common situations: curl followed a redirect and saved HTML; download interrupted leaving a 0-byte file; user saved the AWS docs page instead of global-bundle.pem.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load AmazonDocumentDB TLS CA bundle:
• AmazonDocumentDB option 'tls_ca_file' is required when TLS i
• AmazonDocumentDB TLS CA bundle is not a readable file:
• Could not load keystore
• Could not load truststore

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/958c4c5274e9821a. Report an issue: GitHub.