{"record":{"id":"12c70951923a40b4","repo":"t8y2/dbx","slug":"jks-truststore-contains-no-certificates","errorCode":null,"errorMessage":"JKS truststore contains no certificates","messagePattern":"JKS truststore contains no certificates","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":111,"sourceCode":"\t\t\t\t\treturn nil, parseErr\n\t\t\t\t}\n\t\t\t\tcertificates = append(certificates, certificate)\n\t\t\tcase store.IsPrivateKeyEntry(alias):\n\t\t\t\tchain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)\n\t\t\t\tif getErr != nil {\n\t\t\t\t\treturn nil, getErr\n\t\t\t\t}\n\t\t\t\tfor _, entry := range chain {\n\t\t\t\t\tcertificate, parseErr := x509.ParseCertificate(entry.Content)\n\t\t\t\t\tif parseErr != nil {\n\t\t\t\t\t\treturn nil, parseErr\n\t\t\t\t\t}\n\t\t\t\t\tcertificates = append(certificates, certificate)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif len(certificates) == 0 {\n\t\t\treturn nil, errors.New(\"JKS truststore contains no certificates\")\n\t\t}\n\t\treturn certificates, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn tls.Certificate{}, err\n\t}\n\tswitch normalizedStoreType(storeType, path) {\n\tcase \"PEM\":\n\t\treturn tls.X509KeyPair(contents, contents)\n\tcase \"PKCS12\":\n\t\tprivateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)\n\t\tif err != nil {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L93-L129","documentation":"loadTrustStore parses a Java KeyStore (JKS) truststore file into a list of x509 certificates for TLS. After iterating all entries, if no certificate could be extracted, it returns this error because an empty truststore cannot validate any server certificate. It is thrown by buildTLSConfig/buildZooKeeperTLSConfig when configuring a ZooKeeper TLS connection.","triggerScenarios":"Calling buildZooKeeperTLSConfig/buildTLSConfig with a truststore whose path/type resolves to a JKS file that contains zero certificate entries (only key entries, only metadata entries, or a freshly created empty JKS).","commonSituations":"Pointing trustStorePath at a keystore instead of a truststore; a keytool-generated truststore that never had 'keytool -importcert' run; wrong password causing entries to be skipped silently; a JKS created empty and never populated in CI.","solutions":["Import the CA/server certificate into the truststore: keytool -importcert -alias ca -file ca.pem -keystore truststore.jks","Verify you are pointing at the truststore file, not the client keystore file","Check the truststore password is correct so entries can be read","If you only have PEM certs, use the PEM truststore format instead of JKS"],"exampleFix":"// before: empty truststore\n# keytool -genkeypair -keystore truststore.jks  // wrong: truststores hold certs\n// after\n# keytool -importcert -alias zk-ca -file ca.crt -keystore truststore.jks -storepass changeit -noprompt","handlingStrategy":"validation","validationCode":"// check the JKS truststore has at least one cert before wiring TLS\nout, _ := exec.Command(\"keytool\", \"-list\", \"-keystore\", truststorePath,\n    \"-storepass\", password).Output()\nif !strings.Contains(string(out), \"trustedCertEntry\") {\n    return fmt.Errorf(\"truststore %s has no certificates\", truststorePath)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"JKS truststore contains no certificates\") {\n    // fail fast with actionable config guidance\n}","preventionTips":["Always import the CA into the truststore immediately after creating it","Keep truststore and keystore files under distinct, descriptive names","Validate the store in CI with keytool -list before deployment"],"tags":["tls","jks","truststore","zookeeper","certificates"],"backgroundTag":"empty-truststore","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}