apache/seatunnel · error · IllegalArgumentException

AmazonDocumentDB TLS CA bundle is not a readable file:

Error message

AmazonDocumentDB TLS CA bundle is not a readable file: 

What it means

validateTlsCaFile checks that the configured tls_ca_file path exists, is a regular file, and is readable (Files.isRegularFile && Files.isReadable). If not, it throws IllegalArgumentException naming the offending path. This catches bad paths, directories, and permission problems before the Mongo driver opens a connection.

Source

Thrown at seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java:191

        }
    }

    private static String requireNonBlank(String value, String optionName) {
        if (value == null || value.trim().isEmpty()) {
            throw new IllegalArgumentException(
                    "AmazonDocumentDB option '" + optionName + "' must not be blank");
        }
        return value.trim();
    }

    private static void validateTlsCaFile(String tlsCaFile) {
        if (tlsCaFile == null) {
            throw new IllegalArgumentException(
                    "AmazonDocumentDB option 'tls_ca_file' is required when TLS is enabled");
        }
        Path path = Paths.get(tlsCaFile);
        if (!Files.isRegularFile(path) || !Files.isReadable(path)) {
            throw new IllegalArgumentException(
                    "AmazonDocumentDB TLS CA bundle is not a readable file: " + tlsCaFile);
        }
    }

    private static void validateBsonDocument(String value, String optionName) {
        try {
            BsonDocument.parse(value);
        } catch (RuntimeException e) {
            throw new IllegalArgumentException(
                    "AmazonDocumentDB option '"
                            + optionName
                            + "' must be a valid BSON/JSON document",
                    e);
        }
    }

    /** Builds an isolated trust context from every X.509 certificate in the supplied CA bundle. */
    private static SSLContext createSslContext(Path caBundlePath) {

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify the path with `ls -l <tls_ca_file>` from the host running SeaTunnel and correct it.
2. Use an absolute path and mount the bundle into containers (`-v /path/global-bundle.pem:/opt/certs/global-bundle.pem`).
3. Fix permissions: `chmod 644 /path/global-bundle.pem` or chown to the SeaTunnel OS user.

Example fix

// before
tls_ca_file = "/certs/global-bundle.pem"  // file not mounted in container
// after
tls_ca_file = "/opt/certs/global-bundle.pem"  // mounted, chmod 644

Path p = Paths.get(tlsCaFile);
if (!Files.isRegularFile(p) || !Files.isReadable(p)) {
    throw new IllegalArgumentException("CA bundle missing/unreadable: " + p);
}

When it happens

Trigger: tls_ca_file points to a nonexistent file; the path is a directory; the file exists but the OS user running SeaTunnel lacks read permission; or a dangling symlink.

Common situations: Bundle downloaded on one host but the connector runs in a container without it; relative path that doesn't resolve from the working directory; file copied with root-only permissions.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• AmazonDocumentDB option 'tls_ca_file' is required when TLS i
• Failed to configure TLS settings
• python.script.path does not point to a readable file: {}
• RABBITMQ-09
• No agent.yaml found. Use --config /path/to/agent.yaml, set E

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/06e3ce7f0ed88b59. Report an issue: GitHub.