{"record":{"id":"2e38a1f0cebfbe7e","repo":"elastic/elasticsearch","slug":"the-truststore-path-does-not-contain-any-trus","errorCode":null,"errorMessage":"the truststore [${path}] does not contain any trusted certificate entries","messagePattern":"the truststore \\[(.+?)\\] does not contain any trusted certificate entries","errorType":"validation","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/StoreTrustConfig.java","lineNumber":134,"sourceCode":"        return extra;\n    }\n\n    private String fileTypeForException() {\n        return \"[\" + type + \"] keystore (as a truststore)\";\n    }\n\n    /**\n     * Verifies that the keystore contains at least 1 trusted certificate entry.\n     */\n    private static void checkTrustStore(KeyStore store, Path path) throws GeneralSecurityException {\n        Enumeration<String> aliases = store.aliases();\n        while (aliases.hasMoreElements()) {\n            String alias = aliases.nextElement();\n            if (store.isCertificateEntry(alias)) {\n                return;\n            }\n        }\n        throw new SslConfigException(\"the truststore [\" + path + \"] does not contain any trusted certificate entries\");\n    }\n\n    @Override\n    public boolean equals(Object o) {\n        if (this == o) return true;\n        if (o == null || getClass() != o.getClass()) return false;\n        StoreTrustConfig that = (StoreTrustConfig) o;\n        return truststorePath.equals(that.truststorePath)\n            && Arrays.equals(password, that.password)\n            && type.equals(that.type)\n            && algorithm.equals(that.algorithm);\n    }\n\n    @Override\n    public int hashCode() {\n        int result = Objects.hash(truststorePath, type, algorithm);\n        result = 31 * result + Arrays.hashCode(password);\n        return result;","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/StoreTrustConfig.java#L116-L152","documentation":"checkTrustStore walks every alias of a truststore and returns as soon as it finds a trustedCertificateEntry. If no alias is a certificate entry (e.g. the store holds only PrivateKey entries or is empty), it throws an SslConfigException naming the path. A truststore must contain at least one CA certificate to verify peer chains against.","triggerScenarios":"Loading a keystore via StoreTrustConfig where store.isCertificateEntry(alias) is false for every alias. Typical when a file containing only your own private key (or only key entries) is referenced as truststore.path.","commonSituations":"Swapped keystore and truststore file paths in config; imported the server key but never imported the signing CA; truststore file was generated empty or overwritten; pointing truststore.path at a PKCS#12 that only has a key entry.","solutions":["Import the issuing CA certificate: keytool -importcert -alias ca -file ca.pem -keystore truststore.jks -storetype jks","Verify the result: keytool -list -keystore truststore.jks should list at least one trustedCertEntry","Swap the file references if truststore.path and keystore.path are inverted","Re-export the CA from the server certificate and re-import it"],"exampleFix":"// before: truststore has only a key entry\nkeytool -list -keystore trust.jks  # => PrivateKeyEntry\n// after: import the CA as a trusted cert\nkeytool -importcert -alias root-ca -file ca.pem -keystore trust.jks","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(type);\ntry (InputStream in = Files.newInputStream(path)) { ks.load(in, password); }\nboolean hasCert = Collections.list(ks.aliases()).stream().anyMatch(ks::isCertificateEntry);\nif (!hasCert) throw new IllegalStateException(\"truststore has no trusted cert: \" + path);","typeGuard":"static boolean truststoreHasCertEntry(KeyStore ks) throws KeyStoreException {\n    return Collections.list(ks.aliases()).stream().anyMatch(ks::isCertificateEntry);\n}","tryCatchPattern":"try {\n    new StoreTrustConfig(...);\n} catch (SslConfigException e) {\n    // import the CA before retrying\n    throw e;\n}","preventionTips":["Preflight: keytool -list | grep trustedCertEntry","Distinguish keystore vs truststore files at provisioning time","Import the full CA chain, not just the leaf"],"tags":["ssl","truststore","config","security","startup"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}