{"record":{"id":"512cd200d4e84a37","repo":"elastic/elasticsearch","slug":"cannot-combine-trust-configurations","errorCode":null,"errorMessage":"Cannot combine trust configurations [{}]","messagePattern":"Cannot combine trust configurations \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/CompositeTrustConfig.java","lineNumber":61,"sourceCode":"    }\n\n    @Override\n    public boolean hasExplicitConfig() {\n        return configs.stream().allMatch(SslTrustConfig::hasExplicitConfig);\n    }\n\n    @Override\n    public X509ExtendedTrustManager createTrustManager() {\n        try {\n            Collection<Certificate> trustedIssuers = configs.stream()\n                .map(c -> c.createTrustManager())\n                .map(tm -> tm.getAcceptedIssuers())\n                .flatMap(Arrays::stream)\n                .collect(Collectors.toSet());\n            final KeyStore store = KeyStoreUtil.buildTrustStore(trustedIssuers);\n            return KeyStoreUtil.createTrustManager(store, TrustManagerFactory.getDefaultAlgorithm());\n        } catch (GeneralSecurityException e) {\n            throw new SslConfigException(\n                \"Cannot combine trust configurations [\"\n                    + configs.stream().map(SslTrustConfig::toString).collect(Collectors.joining(\",\"))\n                    + \"]\",\n                e\n            );\n        }\n    }\n\n    @Override\n    public Collection<? extends StoredCertificate> getConfiguredCertificates() {\n        return configs.stream().map(SslTrustConfig::getConfiguredCertificates).flatMap(Collection::stream).toList();\n    }\n\n    @Override\n    public boolean equals(Object o) {\n        if (this == o) return true;\n        if (o == null || getClass() != o.getClass()) return false;\n        CompositeTrustConfig that = (CompositeTrustConfig) o;","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/CompositeTrustConfig.java#L43-L79","documentation":"Thrown as SslConfigException by CompositeTrustConfig.createTrustManager when merging trust anchors from multiple SslTrustConfig entries fails with a GeneralSecurityException. CompositeTrustConfig collects all accepted issuers from each child config, builds a combined KeyStore, and initializes a TrustManagerFactory; any certificate-encoding, keystore-loading, or factory-init failure bubbles up wrapped in this message, which lists the string representation of all configs for diagnosis.","triggerScenarios":"Calling createTrustManager() on a CompositeTrustConfig whose child configs include a corrupt, expired, or unsupported certificate, or whose combined certificate set causes TrustManagerFactory.init() to fail.","commonSituations":"An SSL/TLS configuration combines CA certificates from multiple sources (e.g. a PEM certificate authority file plus a JDK default trust store plus a PKCS#12 file). One certificate is malformed, uses an unsupported algorithm, or has an encoding the default TrustManagerFactory rejects. Common in x-pack security transport or HTTP TLS setup with mixed trust sources.","solutions":["Inspect the exception's cause (GeneralSecurityException) for the specific certificate or algorithm error.","Validate each PEM/DER/PKCS12 certificate file independently with keytool -printcert or openssl x509 -in <file> -text -noout.","Remove or replace the offending certificate from the trust configuration.","If combining many CAs, test them one at a time to isolate the problematic entry."],"exampleFix":"// before — combine multiple trust configs, one has a corrupt cert\nCompositeTrustConfig composite = new CompositeTrustConfig(List.of(pemConfig, p12Config));\ncomposite.createTrustManager();\n\n// after — validate each cert first, drop the bad one\n// run: openssl x509 -in ca.pem -text -noout  (fix or remove failing cert)\nCompositeTrustConfig composite = new CompositeTrustConfig(List.of(validPemConfig, p12Config));\ncomposite.createTrustManager();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    X509ExtendedTrustManager tm = compositeTrustConfig.createTrustManager();\n} catch (SslConfigException e) {\n    // e.getCause() is the GeneralSecurityException with the real reason\n    log.error(\"Failed to build composite trust manager: {}\", e.getMessage(), e.getCause());\n    // isolate which child config fails by calling each createTrustManager() individually\n}","preventionTips":["Validate each certificate file with keytool or openssl before adding it to a trust config.","Test child trust configs individually before composing them.","Log the SslConfigException cause to identify the specific certificate failure."],"tags":["ssl","tls","trust-store","certificate","security","elasticsearch"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}