{"record":{"id":"24dd285357419388","repo":"pentaho/pentaho-kettle","slug":"kettletrustmanager-exception-couldnotopencertstore","errorCode":"KettleTrustManager.Exception.CouldNotOpenCertStore","errorMessage":"KettleTrustManager.Exception.CouldNotOpenCertStore","messagePattern":"KettleTrustManager\\.Exception\\.CouldNotOpenCertStore","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java","lineNumber":63,"sourceCode":"\n  /**\n   *\n   * @param certStorePath\n   * @param certPassword\n   * @throws KettleException\n   */\n  public KettleTrustManager( Bowl bowl, KeyStore keyStore, String certFilename, String certPassword )\n    throws KettleException {\n    try {\n      // Load the CERT key from the file into the store using the provided\n      // password if needed.\n      //\n      InputStream inputStream = null;\n      try {\n        inputStream = KettleVFS.getInstance( bowl ).getInputStream( certFilename );\n        keyStore.load( inputStream, Const.NVL( certPassword, \"\" ).toCharArray() );\n      } catch ( Exception e ) {\n        throw new KettleException( BaseMessages.getString(\n          PKG, \"KettleTrustManager.Exception.CouldNotOpenCertStore\" ), e );\n      } finally {\n        if ( inputStream != null ) {\n          try {\n            inputStream.close();\n          } catch ( Exception e ) {\n            throw new KettleException( BaseMessages.getString(\n              PKG, \"KettleTrustManager.Exception.CouldNotOpenCertStore\" ), e );\n          }\n        }\n      }\n\n      // Now initialize the trust manager...\n      //\n      try {\n        TrustManagerFactory tmf = null;\n        tmf = TrustManagerFactory.getInstance( \"SunX509\" );\n        tmf.init( keyStore );","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java#L45-L81","documentation":"Thrown in the KettleTrustManager constructor when loading the certificate keystore fails: KettleVFS cannot open the cert file, or keyStore.load() rejects the stream/password. The custom trust manager needed for LDAPS cannot be initialized, so secure LDAP connections will fail.","triggerScenarios":"KettleVFS.getInputStream(certFilename) throws (file missing/unreadable) or keyStore.load(inputStream, password) throws (wrong password or corrupt/invalid keystore format).","commonSituations":"Certificate path is wrong or uses an unsupported VFS scheme; password does not match the keystore password; file is not a keystore at all (raw PEM certificate instead of JKS/PKCS12); file permissions block reading.","solutions":["Verify the certificate file exists and is readable at the configured path","Confirm the password matches the keystore (test: keytool -list -keystore file -storepass <pwd>)","Convert PEM certificates to a keystore format: keytool -importcert -file cert.pem -keystore trust.jks","Check the cause chain for the exact VFS/IO or UnrecoverableKeyException reason"],"exampleFix":"// before\nCertificate file: /etc/ldap/server.pem, password: changeit\n// after\nkeytool -importcert -file /etc/ldap/server.pem -alias ldapserver -keystore /etc/ldap/truststore.jks -storepass changeit\n// configure truststore.jks with password changeit","handlingStrategy":"validation","validationCode":"// Validate truststore path, format and password before configuring the step\nFile f = new File(certPath);\nif (!f.isFile()) throw new FileNotFoundException(certPath);\ntry (FileInputStream in = new FileInputStream(f)) {\n  KeyStore ks = KeyStore.getInstance(\"JKS\");\n  ks.load(in, password.toCharArray()); // throws on wrong password/corrupt file\n}","typeGuard":null,"tryCatchPattern":"try {\n  configureTrustStore(certPath, password);\n} catch (KettleException e) {\n  Throwable c = e.getCause();\n  if (c instanceof java.io.FileNotFoundException) { /* fix path */ }\n  else if (c instanceof java.io.IOException) { /* wrong password or bad format */ }\n  throw new IllegalStateException(\"Could not open cert store: \" + c, c);\n}","preventionTips":["Verify the file exists and is readable via the exact path/VFS scheme used","Match the password to the keystore (test with keytool -list)","Convert raw PEM certificates into JKS/PKCS12 keystores"],"tags":["ldap","ssl","keystore","file"],"backgroundTag":"file-not-found","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}