{"record":{"id":"4a20b1996eb37697","repo":"apache/seatunnel","slug":"failed-to-configure-tls-settings","errorCode":null,"errorMessage":"Failed to configure TLS settings","messagePattern":"Failed to configure TLS settings","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java","lineNumber":118,"sourceCode":"            } else {\n                // Trust all certificates (not recommended for production)\n                SSLContext sslContext =\n                        SSLContexts.custom().loadTrustMaterial(new TrustAllStrategy()).build();\n                httpClientBuilder.setSSLContext(sslContext);\n                log.warn(\"TLS certificate verification disabled - not recommended for production\");\n            }\n\n            if (!tlsVerifyHostnames) {\n                httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);\n                log.warn(\"TLS hostname verification disabled - not recommended for production\");\n            }\n\n            log.debug(\n                    \"TLS configuration completed - certificate verification: {}, hostname verification: {}\",\n                    tlsVerifyCertificate,\n                    tlsVerifyHostnames);\n        } catch (Exception e) {\n            throw new RuntimeException(\"Failed to configure TLS settings\", e);\n        }\n    }\n}\n","sourceCodeStart":100,"sourceCodeEnd":122,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java#L100-L122","documentation":"AbstractAuthenticationProvider.configureTLS wraps any failure while applying TLS settings to the REST client (keystore/truststore loading, SSLContext/HostnameVerifier setup) in a RuntimeException with the message 'Failed to configure TLS settings', preserving the original cause.","triggerScenarios":"configure() is called with tls_verify_certificate/tls_verify_hostnames or keystore/truststore paths configured, and an exception occurs while loading the keystore file, reading a password-protected store, or building the SSLContext.","commonSituations":"Wrong keystore/truststore file path; incorrect store password; corrupted or unsupported keystore format (JKS vs PKCS12); missing file read permissions; running in a container where the cert file was not mounted.","solutions":["Look at the 'Caused by' exception for the real reason (file not found, bad password, bad format)","Verify the keystore/truststore path exists and is readable from the SeaTunnel worker process (especially in containers)","Confirm the keystore password and format (JKS vs PKCS12) match the actual file","If certificate verification is intentionally disabled for testing, set tls_verify_certificate=false and tls_verify_hostnames=false explicitly"],"exampleFix":"// before\n\"keystore_path\": \"/etc/certs/es.keystore\"\n// after\n\"keystore_path\": \"/etc/certs/es.keystore.p12\",\n\"keystore_password\": \"changeme\" // password added, format fixed","handlingStrategy":"validation","validationCode":"// Pre-check TLS material before building the client:\nFile ks = new File(keystorePath);\nif (!ks.isFile() || !ks.canRead()) throw new IllegalStateException(\"Keystore missing/unreadable: \" + keystorePath);\n// Optionally verify the password loads the store\ntry (InputStream in = new FileInputStream(ks)) { KeyStore.getInstance(\"PKCS12\").load(in, password.toCharArray()); }","typeGuard":null,"tryCatchPattern":"try {\n    provider.configure(config);\n} catch (RuntimeException e) {\n    throw new IllegalStateException(\"TLS setup failed: \" + e.getCause(), e);\n}","preventionTips":["Mount cert/keystore files into containers and verify readable by the SeaTunnel user","Confirm keystore format (JKS vs PKCS12) matches the code path and the password is correct","Keep TLS settings (tls_verify_certificate, tls_verify_hostnames) explicit in config","Read the 'Caused by' first — the wrapper message hides the root cause"],"tags":["elasticsearch","tls","ssl","configuration"],"backgroundTag":"tls-config-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}