{"record":{"id":"305fd043447a82c6","repo":"conductor-oss/conductor","slug":"invalid-sslprotocol","errorCode":null,"errorMessage":"Invalid sslProtocol ","messagePattern":"Invalid sslProtocol ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"amqp/src/main/java/com/netflix/conductor/contribs/queue/amqp/AMQPObservableQueue.java","lineNumber":508,"sourceCode":"                factory.setVirtualHost(virtualHost);\n            }\n            // Get server port from config\n            final int port = properties.getPort();\n            if (port <= 0) {\n                throw new IllegalArgumentException(\"Port must be greater than 0\");\n            } else {\n                factory.setPort(port);\n            }\n            final boolean useNio = properties.isUseNio();\n            if (useNio) {\n                factory.useNio();\n            }\n            final boolean useSslProtocol = properties.isUseSslProtocol();\n            if (useSslProtocol) {\n                try {\n                    factory.useSslProtocol();\n                } catch (NoSuchAlgorithmException | KeyManagementException e) {\n                    throw new IllegalArgumentException(\"Invalid sslProtocol \", e);\n                }\n            }\n            factory.setConnectionTimeout(properties.getConnectionTimeoutInMilliSecs());\n            factory.setRequestedHeartbeat(properties.getRequestHeartbeatTimeoutInSecs());\n            factory.setNetworkRecoveryInterval(properties.getNetworkRecoveryIntervalInMilliSecs());\n            factory.setHandshakeTimeout(properties.getHandshakeTimeoutInMilliSecs());\n            factory.setAutomaticRecoveryEnabled(true);\n            factory.setTopologyRecoveryEnabled(true);\n            factory.setRequestedChannelMax(properties.getMaxChannelCount());\n            return factory;\n        }\n\n        public AMQPObservableQueue build(\n                final boolean useExchange, final String queueURI, final String queueType) {\n            final AMQPSettings settings = new AMQPSettings(properties, queueType).fromURI(queueURI);\n            final AMQPRetryPattern retrySettings =\n                    new AMQPRetryPattern(\n                            properties.getLimit(), properties.getDuration(), properties.getType());","sourceCodeStart":490,"sourceCodeEnd":526,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/amqp/src/main/java/com/netflix/conductor/contribs/queue/amqp/AMQPObservableQueue.java#L490-L526","documentation":"Thrown as IllegalArgumentException when the AMQP ConnectionFactory cannot initialize SSL/TLS via factory.useSslProtocol(). The underlying cause is a NoSuchAlgorithmException (the JVM has no security provider offering the requested TLS algorithm) or a KeyManagementException (key/trust store misconfiguration). The message itself is unhelpfully empty because the real detail lives on the chained exception 'e'. This fires at connection-factory build time, so it blocks every subsequent queue operation.","triggerScenarios":"conductor.workflow.event-queues.amqp.useSslProtocol=true (or the AMQPObservableQueue.Builder enabling SSL) on a JVM whose security providers do not expose the default algorithm. Also triggered when the JVM's jdk.tls.disabledAlgorithms or a FIPS/java.security policy strips TLSv1.0/TLSv1.1, or when the trust store referenced by javax.net.ssl.trustStore is missing/unreadable.","commonSituations":"Upgrading the runtime to JDK 17/21 where legacy TLS versions are disabled by default; running in a hardened/FIPS container that only allows TLSv1.2/1.3; pointing at a broker expecting an algorithm the JRE does not ship; misconfigured or absent -Djavax.net.ssl.trustStore in the conductor server JVM.","solutions":["Inspect the chained exception: e is the real cause — read its message (NoSuchAlgorithmException names the missing algorithm, KeyManagementException points at the keystore).","If a specific protocol is required, set the broker/JVM to a supported one (TLSv1.2/TLSv1.3) and ensure jdk.tls.disabledAlgorithms in java.security does not exclude it.","For trust-store problems, provide -Djavax.net.ssl.trustStore and -Djavax.net.ssl.trustStorePassword pointing to a readable store containing the broker CA.","If SSL is not actually required, set conductor.workflow.event-queues.amqp.useSslProtocol=false.","On a FIPS/hardened runtime, install a provider (e.g. BouncyCastle FIPS) that offers the algorithm, or switch to a non-FIPS image for the conductor server."],"exampleFix":"// before\nfinal boolean useSslProtocol = properties.isUseSslProtocol();\nif (useSslProtocol) {\n    try {\n        factory.useSslProtocol();\n    } catch (NoSuchAlgorithmException | KeyManagementException e) {\n        throw new IllegalArgumentException(\"Invalid sslProtocol \", e);\n    }\n}\n// after — pin a JDK-supported protocol and surface the real cause\nif (useSslProtocol) {\n    try {\n        factory.useSslProtocol(\"TLSv1.2\"); // or read from properties\n    } catch (NoSuchAlgorithmException | KeyManagementException e) {\n        throw new IllegalArgumentException(\n            \"Invalid sslProtocol (algorithm/keystore error): \" + e.getMessage(), e);\n    }\n}","handlingStrategy":"validation","validationCode":"// Before enabling SSL, confirm the JVM supports the protocol\nimport javax.net.ssl.SSLContext;\nString proto = \"TLSv1.2\"; // or read from properties\ntry {\n    SSLContext.getInstance(proto); // throws NoSuchAlgorithmException if unsupported\n} catch (java.security.NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\"JVM does not support \" + proto + \"; cannot enable AMQP SSL\", e);\n}\n// Also verify the trust store path is readable if set\nString ts = System.getProperty(\"javax.net.ssl.trustStore\");\nif (ts != null && !java.nio.file.Files.isReadable(java.nio.file.Paths.get(ts))) {\n    throw new IllegalStateException(\"Trust store not readable: \" + ts);\n}","typeGuard":null,"tryCatchPattern":"try {\n    factory.useSslProtocol(\"TLSv1.2\");\n} catch (NoSuchAlgorithmException | KeyManagementException e) {\n    // Fail fast with the real cause; this is a startup/config error, not retriable\n    throw new IllegalStateException(\"AMQP SSL init failed: \" + e.getMessage(), e);\n}","preventionTips":["Pin a JDK-supported protocol (TLSv1.2/TLSv1.3) rather than relying on the default.","Validate trust-store readability at startup before opening the broker connection.","Keep jdk.tls.disabledAlgorithms aligned with the broker's supported protocols.","Run conductor on a JVM image that ships the required security providers."],"tags":["amqp","ssl","tls","configuration","security","jvm"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}