{"record":{"id":"0fc027981d428fa3","repo":"apache/seatunnel","slug":"could-not-load-truststore","errorCode":null,"errorMessage":"Could not load truststore","messagePattern":"Could not load truststore","errorType":"exception","errorClass":"DebeziumException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java","lineNumber":1335,"sourceCode":"                                    public void checkServerTrusted(\n                                            X509Certificate[] x509Certificates, String s)\n                                            throws CertificateException {}\n\n                                    @Override\n                                    public X509Certificate[] getAcceptedIssuers() {\n                                        return new X509Certificate[0];\n                                    }\n                                }\n                            };\n                } else {\n                    TrustManagerFactory tmf =\n                            TrustManagerFactory.getInstance(\n                                    TrustManagerFactory.getDefaultAlgorithm());\n                    tmf.init(ks);\n                    trustManagers = tmf.getTrustManagers();\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new DebeziumException(\"Could not load truststore\", e);\n            }\n            // DBZ-1208 Resembles the logic from the upstream BinaryLogClient, only that\n            // the accepted TLS version is passed to the constructed factory\n            final KeyManager[] finalKMS = keyManagers;\n            return new DefaultSSLSocketFactory(acceptedTlsVersion) {\n\n                @Override\n                protected void initSSLContext(SSLContext sc) throws GeneralSecurityException {\n                    sc.init(finalKMS, trustManagers, null);\n                }\n            };\n        }\n\n        return null;\n    }\n\n    private void logStreamingSourceState() {\n        logStreamingSourceState(Level.ERROR);","sourceCodeStart":1317,"sourceCodeEnd":1353,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-cdc/connector-cdc-mysql/src/main/java/io/debezium/connector/mysql/MySqlStreamingChangeEventSource.java#L1317-L1353","documentation":"Thrown when building the SSL socket factory: initializing the TrustManagerFactory from the configured truststore failed with KeyStoreException or NoSuchAlgorithmException. The truststore used to validate the MySQL server certificate could not be loaded or the default trust algorithm is unavailable in the JVM.","triggerScenarios":"connectorConfig specifies a truststore (database.truststore.file) for server certificate verification, and tmf.init(ks) or TrustManagerFactory.getInstance(...) fails — invalid/corrupt truststore, wrong type, or missing algorithm.","commonSituations":"Truststore path wrong or file corrupt; truststore exported in a format the JVM can't parse; custom truststore created with an unusual type (e.g. not JKS/PKCS12); restricted JVM (FIPS) lacking the default TrustManagerFactory algorithm.","solutions":["Verify the truststore path and that the file is a valid keystore: keytool -list -v -keystore truststore.jks.","Confirm the truststore password in the config matches; wrong passwords typically cause parse failures.","Rebuild the truststore from the MySQL server CA cert: keytool -importcert -alias mysql-ca -file ca.pem -keystore truststore.p12 -storetype PKCS12.","Ensure the JVM's cacerts/algorithm support is intact; check java.security settings if running in a FIPS/custom security provider environment.","If server verification is not required, use an SSL mode that doesn't need a truststore (e.g. preferred/disabled)."],"exampleFix":"// before\n\"truststore-file\" = \"/path/truststore.corrupt\",\n\"truststore-passwd\" = \"typo\"\n// after\n\"truststore-file\" = \"/etc/seatunnel/truststore.p12\",\n\"truststore-passwd\" = \"correctpass\"","handlingStrategy":"validation","validationCode":"// Validate the truststore loads and contains trusted certs BEFORE starting the job\nKeyStore ts = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = new FileInputStream(truststorePath)) {\n    ts.load(in, truststorePassword.toCharArray());\n}\nint certs = java.util.Collections.list(ts.aliases()).size();\nif (certs == 0) throw new IllegalStateException(\"truststore is empty\");","typeGuard":null,"tryCatchPattern":"try {\n    startCdcSource(config);\n} catch (DebeziumException e) {\n    if (\"Could not load truststore\".equals(e.getMessage())) {\n        log.error(\"Truststore invalid: path, format, or JVM algorithm issue\", e.getCause());\n        throw new FatalConfigException(\"Fix truststore-file/truststore-passwd in CDC config\", e);\n    }\n    throw e;\n}","preventionTips":["Validate the truststore with keytool -list -v before deployment; keep it in PKCS12 format.","Import the actual MySQL server CA (server ca.pem) that signed the server certificate.","Regenerate the truststore after CA rotation and redeploy configs together.","Check JVM java.security for custom providers/FIPS settings that may remove default algorithms.","If only encryption (not identity verification) is needed, drop the truststore and use a lighter ssl-mode."],"tags":["mysql","cdc","ssl","tls","truststore"],"backgroundTag":"file-read-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}