apache/seatunnel · warning

TLS certificate verification disabled - not recommended for

Error message

TLS certificate verification disabled - not recommended for production

What it means

AbstractAuthenticationProvider.configureTLS builds an SSLContext with TrustAllStrategy when tls_verify_certificate=false, disabling all certificate verification. This warn is logged to flag the insecure configuration; it is not an exception.

Source

Thrown at seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java:105

                Optional<String> truststorePassword =
                        config.getOptional(ElasticsearchBaseOptions.TLS_TRUST_STORE_PASSWORD);

                Optional<SSLContext> sslContext =
                        SSLUtils.buildSSLContext(
                                keystorePath, keystorePassword, truststorePath, truststorePassword);

                if (sslContext.isPresent()) {
                    httpClientBuilder.setSSLContext(sslContext.get());
                    log.debug("Custom SSL context configured with keystore/truststore");
                } else {
                    log.debug("No custom SSL context configured, using default");
                }
            } else {
                // Trust all certificates (not recommended for production)
                SSLContext sslContext =
                        SSLContexts.custom().loadTrustMaterial(new TrustAllStrategy()).build();
                httpClientBuilder.setSSLContext(sslContext);
                log.warn("TLS certificate verification disabled - not recommended for production");
            }

            if (!tlsVerifyHostnames) {
                httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
                log.warn("TLS hostname verification disabled - not recommended for production");
            }

            log.debug(
                    "TLS configuration completed - certificate verification: {}, hostname verification: {}",
                    tlsVerifyCertificate,
                    tlsVerifyHostnames);
        } catch (Exception e) {
            throw new RuntimeException("Failed to configure TLS settings", e);
        }
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Set tls_verify_certificate=true and install the proper CA cert into the truststore
2. Import the cluster's self-signed certificate into a custom truststore referenced by config
3. Only keep verification disabled in isolated dev/test environments

Example fix

// before
url = "https://es:9200"
tls_verify_certificate = false
// after
url = "https://es:9200"
tls_verify_certificate = true
keystore-path = "/path/to/truststore.jks"
keystore-password = "***"

// fail fast in production if TLS verification is off
if ("production".equals(env) && !config.tlsVerifyCertificate) {
    throw new IllegalStateException("tls_verify_certificate must be true in production");
}

When it happens

Trigger: Configuring an Elasticsearch connection with https and setting tls_verify_certificate to false (explicitly or via defaults), then calling configure.

Common situations: Self-signed certificates in dev/test clusters; users disabling verification to bypass PKIX path building failures in production by mistake.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load AmazonDocumentDB TLS CA bundle:
• Could not load keystore
• Could not load truststore
• Unexpected default trust managers:
• Failed to configure TLS settings

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/a00b7f1f697cc153. Report an issue: GitHub.