apache/seatunnel · error · RuntimeException

Failed to configure TLS settings

Error message

Failed to configure TLS settings

What it means

AbstractAuthenticationProvider.configureTLS wraps any failure while applying TLS settings to the REST client (keystore/truststore loading, SSLContext/HostnameVerifier setup) in a RuntimeException with the message 'Failed to configure TLS settings', preserving the original cause.

Source

Thrown at seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java:118

            } else {
                // Trust all certificates (not recommended for production)
                SSLContext sslContext =
                        SSLContexts.custom().loadTrustMaterial(new TrustAllStrategy()).build();
                httpClientBuilder.setSSLContext(sslContext);
                log.warn("TLS certificate verification disabled - not recommended for production");
            }

            if (!tlsVerifyHostnames) {
                httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
                log.warn("TLS hostname verification disabled - not recommended for production");
            }

            log.debug(
                    "TLS configuration completed - certificate verification: {}, hostname verification: {}",
                    tlsVerifyCertificate,
                    tlsVerifyHostnames);
        } catch (Exception e) {
            throw new RuntimeException("Failed to configure TLS settings", e);
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Look at the 'Caused by' exception for the real reason (file not found, bad password, bad format)
2. Verify the keystore/truststore path exists and is readable from the SeaTunnel worker process (especially in containers)
3. Confirm the keystore password and format (JKS vs PKCS12) match the actual file
4. If certificate verification is intentionally disabled for testing, set tls_verify_certificate=false and tls_verify_hostnames=false explicitly

Example fix

// before
"keystore_path": "/etc/certs/es.keystore"
// after
"keystore_path": "/etc/certs/es.keystore.p12",
"keystore_password": "changeme" // password added, format fixed

// Pre-check TLS material before building the client:
File ks = new File(keystorePath);
if (!ks.isFile() || !ks.canRead()) throw new IllegalStateException("Keystore missing/unreadable: " + keystorePath);
// Optionally verify the password loads the store
try (InputStream in = new FileInputStream(ks)) { KeyStore.getInstance("PKCS12").load(in, password.toCharArray()); }

try {
    provider.configure(config);
} catch (RuntimeException e) {
    throw new IllegalStateException("TLS setup failed: " + e.getCause(), e);
}

When it happens

Trigger: configure() is called with tls_verify_certificate/tls_verify_hostnames or keystore/truststore paths configured, and an exception occurs while loading the keystore file, reading a password-protected store, or building the SSLContext.

Common situations: Wrong keystore/truststore file path; incorrect store password; corrupted or unsupported keystore format (JKS vs PKCS12); missing file read permissions; running in a container where the cert file was not mounted.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• RABBITMQ-09
• AmazonDocumentDB option 'tls_ca_file' is required when TLS i
• AmazonDocumentDB TLS CA bundle is not a readable file:
• Could not load keystore

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/4a20b1996eb37697. Report an issue: GitHub.