{"record":{"id":"10c85793e00fa196","repo":"prestodb/presto","slug":"unexpected-default-trust-managers-10c857","errorCode":null,"errorMessage":"Unexpected default trust managers: ","messagePattern":"Unexpected default trust managers: ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":197,"sourceCode":"        if (truststore != null) {\n            try {\n                // Check if truststore has any certificates\n                List<String> aliases = Collections.list(truststore.aliases());\n                if (aliases.isEmpty()) {\n                    throw new GeneralSecurityException(\"Truststore is empty - no trusted certificates found\");\n                }\n                log.debug(\"Truststore contains {} certificate(s): {}\", aliases.size(), aliases);\n            }\n            catch (KeyStoreException e) {\n                throw new GeneralSecurityException(\"Failed to read truststore\", e);\n            }\n        }\n\n        trustManagerFactory.init(truststore);\n\n        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n            throw new RuntimeException(\"Unexpected default trust managers: \" + Arrays.toString(trustManagers));\n        }\n\n        return (X509TrustManager) trustManagers[0];\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws GeneralSecurityException\n    {\n        KeyStore trustStore = getInstance(getDefaultType());\n        boolean loaded = false;\n        Exception lastException = null;\n\n        // First try to load as PEM format\n        try {\n            log.debug(\"Attempting to load truststore as PEM format\");\n            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);\n            if (!certificateChain.isEmpty()) {\n                trustStore.load(null, null);","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L179-L215","documentation":"After initializing the TrustManagerFactory, createTrustManager expects exactly one X509TrustManager. If the JVM returns zero, multiple, or non-X.509 trust managers, it throws RuntimeException('Unexpected default trust managers: ' + Arrays.toString(...)). This guards against unusual security providers returning unsupported manager types.","triggerScenarios":"trustManagerFactory.getTrustManagers() (inside createTrustManager, via trustManager) returns an array of length != 1 or whose element is not an X509TrustManager — typically because a custom JCE/security provider or exotic truststore type produced different manager types.","commonSituations":"Installing a custom security provider (e.g. FIPS provider) on the Presto JVM; a non-X.509 KeyStore type configured for the truststore; unusual JDK builds with extra default trust managers.","solutions":["Check the printed manager list in the message to see what type was returned","Remove or disable custom security providers in java.security that alter default trust manager behavior","Ensure the truststore uses a standard X.509-compatible type (JKS/PKCS12)","Run on a standard JDK (Temurin/OpenJDK) instead of a FIPS or vendor-special build"],"exampleFix":"// before (java.security)\nsecurity.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider\n// after\n# remove/deprioritize the custom provider altering TrustManagerFactory defaults\nsecurity.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider","handlingStrategy":"validation","validationCode":"# detect providers that may change TrustManagerFactory behavior\ngrep -v '^#' $JAVA_HOME/conf/security/java.security | grep security.provider","typeGuard":null,"tryCatchPattern":"try {\n    SSLContext ctx = provider.sslContext(...);\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Unexpected default trust managers\")) {\n        log.error(\"JVM returned non-X509 trust managers; check security providers\", e);\n    }\n    throw e;\n}","preventionTips":["Run Presto on a standard OpenJDK/Temurin build","Audit java.security provider list before enabling FIPS mode","Use standard JKS/PKCS12 keystore types"],"tags":["presto","ssl","trustmanager","jvm"],"backgroundTag":"unexpected-trust-managers","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}