{"record":{"id":"06e3ce7f0ed88b59","repo":"apache/seatunnel","slug":"amazondocumentdb-tls-ca-bundle-is-not-a-readable-f","errorCode":null,"errorMessage":"AmazonDocumentDB TLS CA bundle is not a readable file: ","messagePattern":"AmazonDocumentDB TLS CA bundle is not a readable file: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java","lineNumber":191,"sourceCode":"        }\n    }\n\n    private static String requireNonBlank(String value, String optionName) {\n        if (value == null || value.trim().isEmpty()) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB option '\" + optionName + \"' must not be blank\");\n        }\n        return value.trim();\n    }\n\n    private static void validateTlsCaFile(String tlsCaFile) {\n        if (tlsCaFile == null) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB option 'tls_ca_file' is required when TLS is enabled\");\n        }\n        Path path = Paths.get(tlsCaFile);\n        if (!Files.isRegularFile(path) || !Files.isReadable(path)) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB TLS CA bundle is not a readable file: \" + tlsCaFile);\n        }\n    }\n\n    private static void validateBsonDocument(String value, String optionName) {\n        try {\n            BsonDocument.parse(value);\n        } catch (RuntimeException e) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB option '\"\n                            + optionName\n                            + \"' must be a valid BSON/JSON document\",\n                    e);\n        }\n    }\n\n    /** Builds an isolated trust context from every X.509 certificate in the supplied CA bundle. */\n    private static SSLContext createSslContext(Path caBundlePath) {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java#L173-L209","documentation":"validateTlsCaFile checks that the configured tls_ca_file path exists, is a regular file, and is readable (Files.isRegularFile && Files.isReadable). If not, it throws IllegalArgumentException naming the offending path. This catches bad paths, directories, and permission problems before the Mongo driver opens a connection.","triggerScenarios":"tls_ca_file points to a nonexistent file; the path is a directory; the file exists but the OS user running SeaTunnel lacks read permission; or a dangling symlink.","commonSituations":"Bundle downloaded on one host but the connector runs in a container without it; relative path that doesn't resolve from the working directory; file copied with root-only permissions.","solutions":["Verify the path with `ls -l <tls_ca_file>` from the host running SeaTunnel and correct it.","Use an absolute path and mount the bundle into containers (`-v /path/global-bundle.pem:/opt/certs/global-bundle.pem`).","Fix permissions: `chmod 644 /path/global-bundle.pem` or chown to the SeaTunnel OS user."],"exampleFix":"// before\ntls_ca_file = \"/certs/global-bundle.pem\"  // file not mounted in container\n// after\ntls_ca_file = \"/opt/certs/global-bundle.pem\"  // mounted, chmod 644","handlingStrategy":"validation","validationCode":"Path p = Paths.get(tlsCaFile);\nif (!Files.isRegularFile(p) || !Files.isReadable(p)) {\n    throw new IllegalArgumentException(\"CA bundle missing/unreadable: \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths; verify from the same host/container/user that runs SeaTunnel.","Mount certificates into containers explicitly and set world-readable permissions (644).","Add a pre-flight check script that `test -r` the bundle before job submission."],"tags":["tls","file-not-found","configuration"],"backgroundTag":"file-not-found","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}