{"record":{"id":"0eb25f5153ef9b18","repo":"prestodb/presto","slug":"failed-to-load-truststore-as-both-pem-and-keystore","errorCode":null,"errorMessage":"Failed to load truststore as both PEM and KeyStore format. PEM error: %s, KeyStore error: %s","messagePattern":"Failed to load truststore as both PEM and KeyStore format\\. PEM error: (.+?), KeyStore error: (.+?)","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":242,"sourceCode":"            }\n        }\n        catch (IOException | GeneralSecurityException e) {\n            log.debug(\"Failed to load truststore as PEM format: {}\", e.getMessage());\n            lastException = e;\n        }\n\n        // If PEM loading failed, try standard KeyStore format\n        if (!loaded) {\n            try {\n                log.debug(\"Attempting to load truststore as JKS format\");\n                try (InputStream inputStream = Files.newInputStream(trustStorePath.toPath())) {\n                    trustStore.load(inputStream, trustStorePassword.map(String::toCharArray).orElse(null));\n                }\n                log.debug(\"Successfully loaded truststore as JKS format\");\n            }\n            catch (IOException | GeneralSecurityException e) {\n                log.debug(\"Failed to load truststore as JKS format: {}\", e.getMessage());\n                throw new GeneralSecurityException(\n                        \"Failed to load truststore as both PEM and KeyStore format. \" +\n                                \"PEM error: \" + (lastException != null ? lastException.getMessage() : \"unknown\") +\n                                \", KeyStore error: \" + e.getMessage(), e);\n            }\n        }\n\n        // Verify the truststore is not empty\n        try {\n            List<String> aliases = Collections.list(trustStore.aliases());\n            if (aliases.isEmpty()) {\n                throw new GeneralSecurityException(\"Loaded truststore is empty - no certificates found in: \" + trustStorePath);\n            }\n            log.debug(\"Truststore loaded with {} certificate(s)\", aliases.size());\n        }\n        catch (KeyStoreException e) {\n            throw new GeneralSecurityException(\"Failed to verify truststore contents\", e);\n        }\n","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L224-L260","documentation":"loadTrustStore first tries to parse the configured file as PEM; if that fails it falls back to loading it as a JKS/KeyStore. When both attempts fail it throws GeneralSecurityException with a combined message containing the PEM error and the KeyStore error, meaning the file is neither valid PEM nor a valid KeyStore (or the password is wrong).","triggerScenarios":"loadTrustStore (called from createSSLContext) is given a path whose content parses as neither PEM certificates nor a KeyStore — wrong file entirely, corrupted download, or wrong trustStorePassword making the KeyStore load throw IOException.","commonSituations":"Pointing truststore.path at the keystore file (or vice versa); password mismatch on a JKS store; secret mounted as a truncated/empty file; PKCS12 file supplied while expecting JKS handling quirks.","solutions":["Read the 'PEM error' and 'KeyStore error' portions of the message to see why each parse failed","Verify the file type: openssl crl2pkcs7 -nocrl -certfile f | openssl pkcs7 -print_certs (PEM) or keytool -list (JKS/PKCS12)","Fix the configured path to point at a real truststore containing CA certificates","If it is a KeyStore, confirm the configured trustStorePassword matches"],"exampleFix":"// before (catalog.properties)\nhttp-server.https.truststore.path=/etc/pki/server-keystore.jks   # wrong file\n// after\nhttp-server.https.truststore.path=/etc/pki/ca-truststore.jks\nhttp-server.https.truststore.key=changeit","handlingStrategy":"validation","validationCode":"# verify the file is either valid PEM or a valid KeyStore before configuring it\nopenssl crl2pkcs7 -nocrl -certfile $TS_FILE | openssl pkcs7 -print_certs >/dev/null 2>&1 \\\n  || keytool -list -keystore $TS_FILE -storepass $TS_PASS >/dev/null 2>&1 \\\n  || echo NOT-A-TRUSTSTORE","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the path points at the truststore, not the keystore","Store PEM and KeyStore files in clearly named separate paths","Check mounted secret file sizes/hashes after each deploy","Match trustStorePassword to the actual store type"],"tags":["presto","ssl","truststore","pem","configuration"],"backgroundTag":"truststore-format-unrecognized","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}