{"record":{"id":"0ebc39074ca93c85","repo":"apache/seatunnel","slug":"failed-to-load-amazondocumentdb-tls-ca-bundle","errorCode":null,"errorMessage":"Failed to load AmazonDocumentDB TLS CA bundle: ","messagePattern":"Failed to load AmazonDocumentDB TLS CA bundle: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java","lineNumber":235,"sourceCode":"            }\n\n            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n            trustStore.load(null, null);\n            int certificateIndex = 0;\n            for (Certificate certificate : certificates) {\n                trustStore.setCertificateEntry(\n                        \"amazondocumentdb-ca-\" + certificateIndex, certificate);\n                certificateIndex++;\n            }\n\n            TrustManagerFactory trustManagerFactory =\n                    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            trustManagerFactory.init(trustStore);\n            SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n            sslContext.init(null, trustManagerFactory.getTrustManagers(), null);\n            return sslContext;\n        } catch (IOException | GeneralSecurityException e) {\n            throw new IllegalArgumentException(\n                    \"Failed to load AmazonDocumentDB TLS CA bundle: \" + caBundlePath, e);\n        }\n    }\n\n    public String getUri() {\n        return uri;\n    }\n\n    public String getDatabase() {\n        return database;\n    }\n\n    public String getCollection() {\n        return collection;\n    }\n\n    public boolean isTls() {\n        return tls;","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java#L217-L253","documentation":"createSslContext wraps IOException and GeneralSecurityException (KeyStore/TrustManagerFactory/SSLContext init failures, bad certificate data) in an IllegalArgumentException naming the CA bundle path. This normalizes any TLS trust-store setup failure into a config-time error with the offending file identified.","triggerScenarios":"CA bundle contains corrupt or unsupported certificate encodings; the file is unreadable mid-stream (I/O error); the JVM cannot instantiate the default KeyStore type or TLS algorithm (rare FIPS/restricted-JVM setups).","commonSituations":"Bundle mixes DER and PEM or is truncated mid-certificate; custom JVM without TLS support; disk/filesystem error while reading the file.","solutions":["Open the bundle and fix/replace the corrupt certificate file (re-download global-bundle.pem).","Check the wrapped cause (`Caused by:`) to identify whether it's CertificateException vs KeyStore/SSL issues.","Run on a standard JDK (8+) with unlimited crypto policy if a security exception is reported."],"exampleFix":"// before\ntls_ca_file = \"/opt/certs/bundle.pem\"  // truncated mid-certificate\n// after\ntls_ca_file = \"/opt/certs/global-bundle.pem\"  // re-downloaded intact","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    Path p = Paths.get(caBundle);\n    CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n    try (InputStream in = Files.newInputStream(p)) { cf.generateCertificates(in); }\n} catch (IOException | GeneralSecurityException e) {\n    throw new IllegalStateException(\"CA bundle failed to load: \" + e.getMessage(), e);\n}","preventionTips":["Inspect the Caused-by chain to distinguish corrupt data from JVM security config issues.","Use a standard JDK with default security providers; avoid exotic FIPS setups unless validated.","Re-download bundles from the official AWS trust store rather than regenerating by hand."],"tags":["tls","certificates","security"],"backgroundTag":"invalid-certificate-bundle","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}