apache/seatunnel · error · IllegalArgumentException

Failed to load AmazonDocumentDB TLS CA bundle:

Error message

Failed to load AmazonDocumentDB TLS CA bundle: 

What it means

createSslContext wraps IOException and GeneralSecurityException (KeyStore/TrustManagerFactory/SSLContext init failures, bad certificate data) in an IllegalArgumentException naming the CA bundle path. This normalizes any TLS trust-store setup failure into a config-time error with the offending file identified.

Source

Thrown at seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java:235

            }

            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            trustStore.load(null, null);
            int certificateIndex = 0;
            for (Certificate certificate : certificates) {
                trustStore.setCertificateEntry(
                        "amazondocumentdb-ca-" + certificateIndex, certificate);
                certificateIndex++;
            }

            TrustManagerFactory trustManagerFactory =
                    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(trustStore);
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, trustManagerFactory.getTrustManagers(), null);
            return sslContext;
        } catch (IOException | GeneralSecurityException e) {
            throw new IllegalArgumentException(
                    "Failed to load AmazonDocumentDB TLS CA bundle: " + caBundlePath, e);
        }
    }

    public String getUri() {
        return uri;
    }

    public String getDatabase() {
        return database;
    }

    public String getCollection() {
        return collection;
    }

    public boolean isTls() {
        return tls;

View on GitHub (pinned to cf67b549a7)

Solutions

1. Open the bundle and fix/replace the corrupt certificate file (re-download global-bundle.pem).
2. Check the wrapped cause (`Caused by:`) to identify whether it's CertificateException vs KeyStore/SSL issues.
3. Run on a standard JDK (8+) with unlimited crypto policy if a security exception is reported.

Example fix

// before
tls_ca_file = "/opt/certs/bundle.pem"  // truncated mid-certificate
// after
tls_ca_file = "/opt/certs/global-bundle.pem"  // re-downloaded intact

try {
    Path p = Paths.get(caBundle);
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    try (InputStream in = Files.newInputStream(p)) { cf.generateCertificates(in); }
} catch (IOException | GeneralSecurityException e) {
    throw new IllegalStateException("CA bundle failed to load: " + e.getMessage(), e);
}

When it happens

Trigger: CA bundle contains corrupt or unsupported certificate encodings; the file is unreadable mid-stream (I/O error); the JVM cannot instantiate the default KeyStore type or TLS algorithm (rare FIPS/restricted-JVM setups).

Common situations: Bundle mixes DER and PEM or is truncated mid-certificate; custom JVM without TLS support; disk/filesystem error while reading the file.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• AmazonDocumentDB TLS CA bundle contains no certificates:
• TLS certificate verification disabled - not recommended for
• TLS hostname verification disabled - not recommended for pro
• AmazonDocumentDB option 'tls_ca_file' is required when TLS i
• AmazonDocumentDB TLS CA bundle is not a readable file:

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/0ebc39074ca93c85. Report an issue: GitHub.