apache/seatunnel · error · DebeziumException

Could not load truststore

Error message

Could not load truststore

What it means

Thrown when building the SSL socket factory: initializing the TrustManagerFactory from the configured truststore failed with KeyStoreException or NoSuchAlgorithmException. The truststore used to validate the MySQL server certificate could not be loaded or the default trust algorithm is unavailable in the JVM.

Source

Thrown at seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java:1335

                                    public void checkServerTrusted(
                                            X509Certificate[] x509Certificates, String s)
                                            throws CertificateException {}

                                    @Override
                                    public X509Certificate[] getAcceptedIssuers() {
                                        return new X509Certificate[0];
                                    }
                                }
                            };
                } else {
                    TrustManagerFactory tmf =
                            TrustManagerFactory.getInstance(
                                    TrustManagerFactory.getDefaultAlgorithm());
                    tmf.init(ks);
                    trustManagers = tmf.getTrustManagers();
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new DebeziumException("Could not load truststore", e);
            }
            // DBZ-1208 Resembles the logic from the upstream BinaryLogClient, only that
            // the accepted TLS version is passed to the constructed factory
            final KeyManager[] finalKMS = keyManagers;
            return new DefaultSSLSocketFactory(acceptedTlsVersion) {

                @Override
                protected void initSSLContext(SSLContext sc) throws GeneralSecurityException {
                    sc.init(finalKMS, trustManagers, null);
                }
            };
        }

        return null;
    }

    private void logStreamingSourceState() {
        logStreamingSourceState(Level.ERROR);

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify the truststore path and that the file is a valid keystore: keytool -list -v -keystore truststore.jks.
2. Confirm the truststore password in the config matches; wrong passwords typically cause parse failures.
3. Rebuild the truststore from the MySQL server CA cert: keytool -importcert -alias mysql-ca -file ca.pem -keystore truststore.p12 -storetype PKCS12.
4. Ensure the JVM's cacerts/algorithm support is intact; check java.security settings if running in a FIPS/custom security provider environment.
5. If server verification is not required, use an SSL mode that doesn't need a truststore (e.g. preferred/disabled).

Example fix

// before
"truststore-file" = "/path/truststore.corrupt",
"truststore-passwd" = "typo"
// after
"truststore-file" = "/etc/seatunnel/truststore.p12",
"truststore-passwd" = "correctpass"

// Validate the truststore loads and contains trusted certs BEFORE starting the job
KeyStore ts = KeyStore.getInstance("PKCS12");
try (InputStream in = new FileInputStream(truststorePath)) {
    ts.load(in, truststorePassword.toCharArray());
}
int certs = java.util.Collections.list(ts.aliases()).size();
if (certs == 0) throw new IllegalStateException("truststore is empty");

try {
    startCdcSource(config);
} catch (DebeziumException e) {
    if ("Could not load truststore".equals(e.getMessage())) {
        log.error("Truststore invalid: path, format, or JVM algorithm issue", e.getCause());
        throw new FatalConfigException("Fix truststore-file/truststore-passwd in CDC config", e);
    }
    throw e;
}

When it happens

Trigger: connectorConfig specifies a truststore (database.truststore.file) for server certificate verification, and tmf.init(ks) or TrustManagerFactory.getInstance(...) fails — invalid/corrupt truststore, wrong type, or missing algorithm.

Common situations: Truststore path wrong or file corrupt; truststore exported in a format the JVM can't parse; custom truststore created with an unusual type (e.g. not JKS/PKCS12); restricted JVM (FIPS) lacking the default TrustManagerFactory algorithm.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• Could not load keystore
• Error reading MySQL variables:
• Unexpected error while connecting to MySQL and looking at GT
• Unexpected error while connecting to MySQL and looking at gt
• Unexpected error while connecting to MySQL and looking at pr

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/0fc027981d428fa3. Report an issue: GitHub.