{"record":{"id":"087e800e1a2a94b5","repo":"elastic/elasticsearch","slug":"cannot-specify-both-and","errorCode":null,"errorMessage":"cannot specify both [{}] and [{}]","messagePattern":"cannot specify both \\[(.+?)\\] and \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":348,"sourceCode":"            verificationMode,\n            clientAuth,\n            ciphers,\n            protocols,\n            handshakeTimeoutMillis\n        );\n    }\n\n    protected SslTrustConfig buildTrustConfig(\n        Path basePath,\n        SslVerificationMode verificationMode,\n        SslKeyConfig keyConfig,\n        @Nullable Set<X509Field> restrictedTrustFields\n    ) {\n        final List<String> certificateAuthorities = resolveListSetting(CERTIFICATE_AUTHORITIES, Function.identity(), null);\n        final String trustStorePath = resolveSetting(TRUSTSTORE_PATH, Function.identity(), null);\n\n        if (certificateAuthorities != null && trustStorePath != null) {\n            throw new SslConfigException(\n                \"cannot specify both [\" + settingPrefix + CERTIFICATE_AUTHORITIES + \"] and [\" + settingPrefix + TRUSTSTORE_PATH + \"]\"\n            );\n        }\n        if (verificationMode.isCertificateVerificationEnabled() == false) {\n            return TrustEverythingConfig.TRUST_EVERYTHING;\n        }\n        if (certificateAuthorities != null) {\n            return new PemTrustConfig(certificateAuthorities, basePath);\n        }\n        if (trustStorePath != null) {\n            final char[] password = resolvePasswordSetting(TRUSTSTORE_SECURE_PASSWORD, TRUSTSTORE_LEGACY_PASSWORD);\n            final String storeType = resolveSetting(TRUSTSTORE_TYPE, Function.identity(), inferKeyStoreType(trustStorePath));\n            final String algorithm = resolveSetting(TRUSTSTORE_ALGORITHM, Function.identity(), TrustManagerFactory.getDefaultAlgorithm());\n            return new StoreTrustConfig(trustStorePath, password, storeType, algorithm, true, basePath);\n        }\n        return buildDefaultTrustConfig(defaultTrustConfig, keyConfig);\n    }\n","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L330-L366","documentation":"buildTrustConfig refuses configurations that supply both PEM certificate authorities (ssl.certificate_authorities) and a truststore path (ssl.truststore.path). The two are alternative ways to specify trust material; specifying both is ambiguous.","triggerScenarios":"Both ssl.certificate_authorities and ssl.truststore.path are set under the same prefix (http.ssl., transport.ssl., etc.). Triggered during load, before any file is read.","commonSituations":"Migration from PEM to PKCS12 truststore where the old PEM CA entry was left in the config; copy-paste of an example that included both; environment overlay that adds a truststore on top of a PEM-based base config.","solutions":["Choose one trust source: keep either certificate_authorities (PEM) or truststore.path (JKS/PKCS12), remove the other.","If you need both sets of CAs, merge them into a single truststore (keytool -importcert) or a single PEM bundle.","Run a config audit per ssl.* prefix to ensure only one trust style is declared."],"exampleFix":"# before\nxpack.security.http.ssl.certificate_authorities: [ \"ca.pem\" ]\nxpack.security.http.ssl.truststore.path: \"trust.jks\"\n# after (pick one)\nxpack.security.http.ssl.truststore.path: \"trust.jks\"\n#   (and remove the certificate_authorities line)","handlingStrategy":"validation","validationCode":"void checkTrustConfig(Map<String,String> settings, String prefix) {\n    boolean hasCa = settings.containsKey(prefix + \"certificate_authorities\");\n    boolean hasTs = settings.containsKey(prefix + \"truststore.path\");\n    if (hasCa && hasTs)\n        throw new IllegalArgumentException(\"Specify either \" + prefix + \"certificate_authorities OR \" + prefix + \"truststore.path, not both\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Maintain a single source of trust per ssl.* prefix.","When migrating trust material, remove the old entry in the same commit.","Lint config for the simultaneous presence of these two keys."],"tags":["ssl","config","truststore","pem","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}