{"record":{"id":"4b2c6f63bcfccaeb","repo":"pentaho/pentaho-kettle","slug":"rest-error-keystoreexception","errorCode":"Rest.Error.KeyStoreException","errorMessage":"Rest.Error.KeyStoreException","messagePattern":"Rest\\.Error\\.KeyStoreException","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java","lineNumber":367,"sourceCode":"              .credentials( data.realHttpLogin, data.realHttpPassword )\n              .build();\n        }\n      }\n      // SSL TRUST STORE CONFIGURATION\n      setSSLConfiguration( data );\n    }\n  }\n\n  protected void setSSLConfiguration( RestData data ) throws KettleException {\n    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {\n      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),\n        trustStoreIn,\n        data.trustStorePassword );\n\n    } catch ( NoSuchAlgorithmException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.NoSuchAlgorithm\" ), e );\n    } catch ( KeyStoreException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyStoreException\" ), e );\n    } catch ( CertificateException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.CertificateException\" ), e );\n    } catch ( FileNotFoundException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.FileNotFound\", data.trustStoreFile ), e );\n    } catch ( IOException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.IOException\" ), e );\n    } catch ( KeyManagementException | UnrecoverableKeyException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyManagementException\" ), e );\n    }\n  }\n\n  /**\n   * Get an InputStream for the file with the given name.\n   * If the file name is empty or null, returns null.\n   *\n   * @param fileName the file name to get InputStream from\n   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null\n   * @throws KettleException if any error occurs while getting the InputStream","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java#L349-L385","documentation":"setSSLConfiguration wraps java.security.KeyStoreException from HttpClientManager.getSslContext in a KettleException with Rest.Error.KeyStoreException. This occurs when the trust store cannot be loaded or initialized — typically a corrupt store, wrong type, wrong password handling at the KeyStore level, or an uninitialized store.","triggerScenarios":"Trust store file is corrupt/not a keystore, the keystore type is wrong for the file format, or getSslContext fails while instantiating the KeyStore from the provided input stream.","commonSituations":"Trust store file overwritten or truncated; password file/export produced a different store format than assumed; file actually a PEM cert rather than a keystore; wrong store type passed in step settings.","solutions":["Validate the trust store: keytool -list -keystore <file> -storepass <pwd> — fix or recreate if it fails","Confirm the store type in the step settings matches the file format (JKS vs PKCS12)","Re-import the server certificate into a fresh trust store","Verify the trust store path points at the intended file (not a cert PEM or another artifact)","Check the cause chain for the precise KeyStoreException reason"],"exampleFix":"// before\nkeytool -list -keystore truststore.jks\n// after\nkeytool -list -keystore truststore.p12 -storetype PKCS12 -storepass changeit","handlingStrategy":"validation","validationCode":"// validate the trust store before configuring SSL\njava.io.File ts = new java.io.File( data.trustStoreFile );\nif ( !ts.isFile() || ts.length() == 0 ) {\n  throw new IllegalStateException( \"Trust store missing or empty: \" + data.trustStoreFile );\n}\njava.security.KeyStore ks = java.security.KeyStore.getInstance( \"PKCS12\" );\ntry ( var in = new java.io.FileInputStream( ts ) ) {\n  ks.load( in, password ); // throws if corrupt or wrong type\n}","typeGuard":null,"tryCatchPattern":"try {\n  step.setConfig( meta, data, row );\n} catch ( KettleException e ) {\n  if ( e.getMessage().contains( \"KeyStoreException\" ) ) {\n    log.error( \"Cannot load trust store — verify file format (JKS vs PKCS12) and integrity\", e );\n  }\n}","preventionTips":["Run keytool -list against the trust store before deploying it","Match the store type setting to the actual file format","Never pass a raw PEM certificate as a keystore file","Check file integrity after copying the store between machines"],"tags":["ssl","keystore","java"],"backgroundTag":"ssl-configuration-error","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}