{"record":{"id":"36dae270aa1390e8","repo":"elastic/elasticsearch","slug":"cannot-retrieve-secure-setting","errorCode":null,"errorMessage":"cannot retrieve secure setting [{}]","messagePattern":"cannot retrieve secure setting \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":472,"sourceCode":"            return parser.apply(setting);\n        } catch (RuntimeException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SslConfigException(\"cannot retrieve setting [\" + settingPrefix + key + \"]\", e);\n        }\n    }\n\n    private char[] resolveSecureSetting(String key, char[] defaultValue) {\n        try {\n            char[] setting = getSecureSetting(expandSettingKey(key));\n            if (setting == null || setting.length == 0) {\n                return defaultValue;\n            }\n            return setting;\n        } catch (RuntimeException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SslConfigException(\"cannot retrieve secure setting [\" + settingPrefix + key + \"]\", e);\n        }\n\n    }\n\n    private <V> List<V> resolveListSetting(String key, Function<String, V> parser, List<V> defaultValue) {\n        try {\n            final List<String> list = getSettingAsList(expandSettingKey(key));\n            if (list == null || list.isEmpty()) {\n                return defaultValue;\n            }\n            return list.stream().map(parser).collect(Collectors.toList());\n        } catch (RuntimeException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SslConfigException(\"cannot retrieve setting [\" + settingPrefix + key + \"]\", e);\n        }\n    }\n}","sourceCodeStart":454,"sourceCodeEnd":490,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L454-L490","documentation":"resolveSecureSetting wraps any checked (non-Runtime) Exception thrown by getSecureSetting while reading a secure (keystore-backed) char[] value. RuntimeExceptions are rethrown unchanged. The error names the full setting key (prefix + key) and attaches the cause.","triggerScenarios":"A custom SslConfigurationLoader subclass's getSecureSetting implementation throws a checked Exception while loading a secure credential (keystore password, key passphrase) — for example a remote secrets backend that throws IOException.","commonSituations":"Custom secrets-backend integration that throws checked exceptions; corrupted Elasticsearch keystore; permission failure reading the keystore file.","solutions":["Inspect the attached cause — it identifies the real I/O or permission failure.","Ensure the keystore file exists, is readable by the ES user, and is well-formed (bin/elasticsearch-keystore list).","If using a custom backend, wrap its checked exceptions in RuntimeException inside getSecureSetting."],"exampleFix":"// before: subclass throws checked exception on secure read\npublic char[] getSecureSetting(String key) throws IOException {\n    return secretsManager.readSecret(key);\n}\n// after: wrap to a RuntimeException\npublic char[] getSecureSetting(String key) {\n    try { return secretsManager.readSecret(key); }\n    catch (IOException e) { throw new RuntimeException(e); }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    SslConfiguration cfg = loader.load(basePath);\n} catch (SslConfigException e) {\n    if (e.getMessage().startsWith(\"cannot retrieve secure setting\")) {\n        Throwable cause = e.getCause();\n        log.error(\"Secure settings source failure for {}: {}\", e.getMessage(), cause.toString());\n    }\n    throw e;\n}","preventionTips":["In custom loaders, wrap checked exceptions inside getSecureSetting.","Ensure the Elasticsearch keystore is readable and not corrupted (bin/elasticsearch-keystore list).","Test secure-settings reload paths in staging before production rollover."],"tags":["ssl","config","secrets","settings","integration"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}