{"record":{"id":"0fadb3e3862b22f2","repo":"pentaho/pentaho-kettle","slug":"kettletrustmanager-exception-couldnotinitializetrustmanager","errorCode":"KettleTrustManager.Exception.CouldNotInitializeTrustManager","errorMessage":"KettleTrustManager.Exception.CouldNotInitializeTrustManager","messagePattern":"KettleTrustManager\\.Exception\\.CouldNotInitializeTrustManager","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java","lineNumber":85,"sourceCode":"          try {\n            inputStream.close();\n          } catch ( Exception e ) {\n            throw new KettleException( BaseMessages.getString(\n              PKG, \"KettleTrustManager.Exception.CouldNotOpenCertStore\" ), e );\n          }\n        }\n      }\n\n      // Now initialize the trust manager...\n      //\n      try {\n        TrustManagerFactory tmf = null;\n        tmf = TrustManagerFactory.getInstance( \"SunX509\" );\n        tmf.init( keyStore );\n        TrustManager[] tms = tmf.getTrustManagers();\n        tm = (X509TrustManager) tms[0];\n      } catch ( Exception e ) {\n        throw new KettleException( BaseMessages.getString(\n          PKG, \"KettleTrustManager.Exception.CouldNotInitializeTrustManager\" ), e );\n      }\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString(\n        PKG, \"KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager\" ), e );\n    }\n  }\n\n  /**\n   * Pass method from x509TrustManager to this class...\n   *\n   * @return an array of certificate authority certificates which are trusted for authenticating peers\n   */\n  public X509Certificate[] getAcceptedIssuers() {\n    if ( tm == null ) {\n      return null;\n    }\n    return tm.getAcceptedIssuers();","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java#L67-L103","documentation":"Thrown when the default JVM TrustManagerFactory (SunX509) cannot be created or initialized with the loaded keystore, so the X509TrustManager cannot be obtained. This is the inner failure of KettleTrustManager's initialization, typically meaning the keystore is empty/invalid or the security provider setup is broken.","triggerScenarios":"TrustManagerFactory.getInstance(\"SunX509\") throws NoSuchAlgorithmException, or tmf.init(keyStore) / getTrustManagers() throws (null or invalid keystore, or tms[0] is not X509TrustManager).","commonSituations":"Keystore loaded but contains no trusted certificate entries; keystore is null due to an earlier silent failure; non-JVM-standard provider environment lacking SunX509; corrupted JVM security config (java.security).","solutions":["Ensure the keystore contains trustedCertEntry entries: keytool -list -keystore truststore.jks","Import the LDAP server certificate into the keystore with keytool -importcert","Check java.security providers; on unusual JVMs try a different TrustManagerFactory algorithm","Verify the keystore loaded non-null before constructing the trust manager"],"exampleFix":"// before (empty truststore)\nkeytool -list -keystore trust.jks  ->  0 entries\n// after\nkeytool -importcert -alias ldapserver -file server.crt -keystore trust.jks -storepass changeit -noprompt","handlingStrategy":"validation","validationCode":"// Ensure the keystore actually contains entries before building the trust manager\nKeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (FileInputStream in = new FileInputStream(ksFile)) { ks.load(in, pwd.toCharArray()); }\nif (ks.size() == 0) throw new IllegalStateException(\"Truststore has no certificate entries\");","typeGuard":null,"tryCatchPattern":"try {\n  configureTrustStore(ksFile, pwd);\n} catch (KettleException e) {\n  Throwable c = e.getCause();\n  if (c instanceof java.security.NoSuchAlgorithmException) { /* JVM lacks SunX509; check java.security */ }\n  throw new IllegalStateException(\"Trust manager init failed: \" + c, c);\n}","preventionTips":["Import the LDAP server certificate so the truststore is non-empty","Verify SunX509 support on non-standard JVMs","Keep JVM java.security provider configuration intact"],"tags":["ldap","ssl","trust-manager","jvm"],"backgroundTag":"module-init-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}