apache/seatunnel · error · RuntimeException

Unexpected default trust managers:

Error message

Unexpected default trust managers:

What it means

SSLUtils.createSSLContext (via buildSSLContext) initializes a TrustManagerFactory from the given trust store and expects exactly one X509TrustManager. If the JDK/provider returns zero or multiple trust managers, or a non-X509 one, it throws RuntimeException 'Unexpected default trust managers: ...'.

Source

Thrown at seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java:111

            keyManagers = keyManagerFactory.getKeyManagers();
        }

        // load TrustStore if configured, otherwise use KeyStore
        KeyStore trustStore = keyStore;
        if (trustStorePath.isPresent()) {
            File trustStoreFile = new File(trustStorePath.get());
            trustStore = loadTrustStore(trustStoreFile, trustStorePassword);
        }

        // create TrustManagerFactory
        TrustManagerFactory trustManagerFactory =
                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        // get X509TrustManager
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException(
                    "Unexpected default trust managers:" + Arrays.toString(trustManagers));
        }
        // create SSLContext
        SSLContext result = SSLContext.getInstance("SSL");
        result.init(keyManagers, trustManagers, null);
        return result;
    }

    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)
            throws IOException, GeneralSecurityException {
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        try {
            // attempt to read the trust store as a PEM file
            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);
            if (!certificateChain.isEmpty()) {
                trustStore.load(null, null);
                for (X509Certificate certificate : certificateChain) {
                    X500Principal principal = certificate.getSubjectX500Principal();

View on GitHub (pinned to cf67b549a7)

Solutions

1. Check Arrays.toString output in the message to see what managers were returned; identify the offending security provider.
2. Switch to a standard JDK (Temurin/OpenJDK 8/11/17) with default security providers.
3. Remove custom security.provider entries from java.security that override TrustManagerFactory behavior.
4. Patch SSLUtils to pick the first X509TrustManager from the array instead of requiring length == 1.

Example fix

// before
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) throw ...
// after
X509TrustManager x509 = Arrays.stream(trustManagers)
    .filter(tm -> tm instanceof X509TrustManager)
    .map(tm -> (X509TrustManager) tm).findFirst()
    .orElseThrow(() -> new RuntimeException("no X509TrustManager"));

// Java: pre-flight trust manager check
TrustManager[] tms = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).getTrustManagers();
boolean ok = tms != null && tms.length == 1 && tms[0] instanceof X509TrustManager;
if (!ok) throw new IllegalStateException("JDK provider returns non-standard trust managers: " + Arrays.toString(tms));

try { sslContext = SSLUtils.buildSSLContext(...); } catch (RuntimeException e) { if (e.getMessage().startsWith("Unexpected default trust managers")) { log.error("Non-standard JDK security provider: {}", e.getMessage()); throw e; } throw e; }

When it happens

Trigger: buildSSLContext called with a trustStore whose default-algorithm TrustManagerFactory yields an unexpected manager array — typically a non-standard security provider, a trustStore containing unusual entries, or exotic JDK/vendor implementations.

Common situations: Running on an unusual JRE (IBM/OpenJ9 or old JDK) where getDefaultAlgorithm resolves differently; a custom java.security security.provider registration; FIPS providers returning extra trust managers.

Related errors

• Could not load keystore
• Could not load truststore
• KeyStore certificate is expired:
• KeyStore certificate is not yet valid:
• Failed to configure TLS settings

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/c4a90add1fe1f5f0. Report an issue: GitHub.