{"record":{"id":"4e2e9b84ee5fd00d","repo":"prestodb/presto","slug":"failed-to-read-truststore","errorCode":null,"errorMessage":"Failed to read truststore","messagePattern":"Failed to read truststore","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":189,"sourceCode":"    }\n\n    private X509TrustManager createTrustManager(KeyStore truststore) throws GeneralSecurityException\n    {\n        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(getDefaultAlgorithm());\n\n        // When truststore is null, TrustManagerFactory will use JVM's system default truststore\n        // When truststore is not null, validate it contains certificates before using it\n        if (truststore != null) {\n            try {\n                // Check if truststore has any certificates\n                List<String> aliases = Collections.list(truststore.aliases());\n                if (aliases.isEmpty()) {\n                    throw new GeneralSecurityException(\"Truststore is empty - no trusted certificates found\");\n                }\n                log.debug(\"Truststore contains {} certificate(s): {}\", aliases.size(), aliases);\n            }\n            catch (KeyStoreException e) {\n                throw new GeneralSecurityException(\"Failed to read truststore\", e);\n            }\n        }\n\n        trustManagerFactory.init(truststore);\n\n        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n            throw new RuntimeException(\"Unexpected default trust managers: \" + Arrays.toString(trustManagers));\n        }\n\n        return (X509TrustManager) trustManagers[0];\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws GeneralSecurityException\n    {\n        KeyStore trustStore = getInstance(getDefaultType());\n        boolean loaded = false;","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L171-L207","documentation":"While validating the truststore, a KeyStoreException from truststore.aliases() (the store was not loaded properly) is wrapped in GeneralSecurityException('Failed to read truststore'). It signals the KeyStore object exists but its entries cannot be enumerated, usually due to load/password problems.","triggerScenarios":"createTrustManager (via trustManager) calls truststore.aliases() on a KeyStore instance whose load step did not complete correctly — KeyStoreException is caught and rethrown with this message.","commonSituations":"Corrupted truststore file; password mismatch causing partial initialization; provider mismatch (store created with a provider unavailable at runtime).","solutions":["Inspect the wrapped KeyStoreException cause in the stack trace","Re-load the truststore with the correct password (keytool -list to verify)","Regenerate the truststore file if corrupted","Ensure the same JCE provider/JVM version is used to create and read the store"],"exampleFix":"// diagnose\nkeytool -list -v -keystore truststore.jks -storepass <pass>\n// if 'Keystore was tampered with, or password was incorrect' -> fix password or regenerate store","handlingStrategy":"validation","validationCode":"# confirm the store loads correctly before use\nkeytool -list -v -keystore truststore.jks -storepass $TS_PASS >/dev/null 2>&1 && echo LOADABLE","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate password correctness with keytool in deploy scripts","Avoid copying truststores across JVM/provider versions without re-testing","Checksum truststore files to detect corruption"],"tags":["presto","ssl","truststore","keystore"],"backgroundTag":"truststore-read-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}