{"record":{"id":"165d98ffb4a0ca02","repo":"elastic/elasticsearch","slug":"unexpected-error-initializing-a-new-in-memory-keys","errorCode":null,"errorMessage":"Unexpected error initializing a new in-memory keystore","messagePattern":"Unexpected error initializing a new in-memory keystore","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java","lineNumber":134,"sourceCode":"        int counter = 0;\n        for (Certificate certificate : certificates) {\n            store.setCertificateEntry(\"cert-\" + counter, certificate);\n            counter++;\n        }\n        return store;\n    }\n\n    private static KeyStore buildNewKeyStore() throws GeneralSecurityException {\n        return buildNewKeyStore(KeyStore.getDefaultType());\n    }\n\n    private static KeyStore buildNewKeyStore(String type) throws GeneralSecurityException {\n        KeyStore keyStore = KeyStore.getInstance(type);\n        try {\n            keyStore.load(null, null);\n        } catch (IOException e) {\n            // This should never happen so callers really shouldn't be forced to deal with it themselves.\n            throw new SslConfigException(\"Unexpected error initializing a new in-memory keystore\", e);\n        }\n        return keyStore;\n    }\n\n    /**\n     * Returns a {@link X509ExtendedKeyManager} that is built from the provided private key and certificate chain\n     */\n    public static X509ExtendedKeyManager createKeyManager(Certificate[] certificateChain, PrivateKey privateKey, char[] password)\n        throws GeneralSecurityException, IOException {\n        KeyStore keyStore = buildKeyStore(List.of(certificateChain), privateKey, password);\n        return createKeyManager(keyStore, password, KeyManagerFactory.getDefaultAlgorithm());\n    }\n\n    /**\n     * Creates a {@link X509ExtendedKeyManager} based on the key material in the provided {@link KeyStore}\n     */\n    public static X509ExtendedKeyManager createKeyManager(KeyStore keyStore, char[] password, String algorithm)\n        throws GeneralSecurityException {","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java#L116-L152","documentation":"Thrown by KeyStoreUtil.buildNewKeyStore() when KeyStore.load(null, null) — initializing an empty in-memory keystore — unexpectedly raises an IOException. The code considers this a 'should never happen' path: loading an empty keystore with no input stream normally cannot fail, so the exception is wrapped in SslConfigException to relieve callers from declaring IOException.","triggerScenarios":"buildNewKeyStore(type) calls KeyStore.getInstance(type).load(null, null). On rare JVMs or with non-default security providers, the no-arg load can fail — e.g. a provider that demands an actual input stream, a corrupted JCE configuration, or a SecurityManager/manager-policy rejection.","commonSituations":"Custom JCE provider registered as default keystore type that does not support empty init; classpath/module issues loading the keystore SPI; FIPS-mode JVM (BCFIPS) where the default type behaves differently; or a JVM that has been misconfigured (java.security corrupted).","solutions":["Inspect the wrapped cause (SslConfigException.getCause()) — it carries the real IOException from the provider.","Verify the default keystore type: check `KeyStore.getDefaultType()` and the `keystore.type` entry in `java.security`.","On FIPS/BCFIPS, follow Elastic's FIPS documentation to configure the keystore type and provider correctly.","Try a fresh JVM/JDK install if the JCE configuration is corrupted."],"exampleFix":"// before: relying on default keystore type in a constrained JVM\nKeyStore ks = KeyStoreUtil.buildKeyStore(certs, key, pwd); // wraps IOException\n\n// after: explicit type aligned with the available provider\nKeyStore ks = KeyStore.getInstance(\"PKCS12\");\nks.load(null, null);\nks.setKeyEntry(\"key\", key, pwd, certs.toArray(new Certificate[0]));","handlingStrategy":"try-catch","validationCode":"// Smoke-test that an empty keystore of the configured type can be initialised.\npublic static boolean canInitEmptyKeyStore(String type) {\n    try {\n        KeyStore ks = KeyStore.getInstance(type);\n        ks.load(null, null);\n        return true;\n    } catch (Exception e) {\n        return false;\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    return KeyStoreUtil.buildKeyStore(certChain, key, pwd);\n} catch (SslConfigException e) {\n    // getCause() is the original IOException from KeyStore.load\n    log.error(\"keystore init failed; check default keystore type and JCE provider\", e.getCause());\n    throw e;\n}","preventionTips":["Pin the keystore type explicitly (e.g. PKCS12) rather than relying on the JVM default.","On FIPS/BCFIPS, follow Elastic's FIPS configuration guide.","Inspect SslConfigException.getCause() to find the underlying provider error."],"tags":["ssl","keystore","jce","elasticsearch","crypto","jvm-config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}