{"record":{"id":"5785cb881c059e7a","repo":"elastic/elasticsearch","slug":"setting-prefix-must-be-blank-or-end-in","errorCode":null,"errorMessage":"Setting prefix [{}] must be blank or end in '.'","messagePattern":"Setting prefix \\[(.+?)\\] must be blank or end in '\\.'","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":183,"sourceCode":"    private List<String> defaultCiphers;\n    private List<String> defaultProtocols;\n    private List<X509Field> defaultRestrictedTrustFields;\n\n    private Function<KeyStore, KeyStore> keyStoreFilter;\n\n    /**\n     * Construct a new loader with the \"standard\" default values.\n     *\n     * @param settingPrefix The prefix to apply to all settings that are loaded. It may be the empty string, otherwise it\n     *                      must end in a \".\" (period). For example, if the prefix is {@code \"reindex.ssl.\"} then the keys that are\n     *                      passed to methods like {@link #getSettingAsString(String)} will be in the form\n     *                      {@code \"reindex.ssl.verification_mode\"}, and those same keys will be reported in error messages (via\n     *                      {@link SslConfigException}).\n     */\n    public SslConfigurationLoader(String settingPrefix) {\n        this.settingPrefix = settingPrefix == null ? \"\" : settingPrefix;\n        if (this.settingPrefix.isEmpty() == false && this.settingPrefix.endsWith(\".\") == false) {\n            throw new IllegalArgumentException(\"Setting prefix [\" + settingPrefix + \"] must be blank or end in '.'\");\n        }\n        this.defaultTrustConfig = new DefaultJdkTrustConfig();\n        this.defaultKeyConfig = EmptyKeyConfig.INSTANCE;\n        this.defaultVerificationMode = SslVerificationMode.FULL;\n        this.defaultClientAuth = SslClientAuthenticationMode.OPTIONAL;\n        this.defaultProtocols = DEFAULT_PROTOCOLS;\n        this.defaultCiphers = DEFAULT_CIPHERS;\n        this.defaultRestrictedTrustFields = GLOBAL_DEFAULT_RESTRICTED_TRUST_FIELDS;\n    }\n\n    /**\n     * Change the default trust config.\n     * The initial trust config is {@link DefaultJdkTrustConfig}, which trusts the JDK's default CA certs\n     */\n    public void setDefaultTrustConfig(SslTrustConfig defaultTrustConfig) {\n        this.defaultTrustConfig = defaultTrustConfig;\n    }\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L165-L201","documentation":"SslConfigurationLoader's constructor requires the setting prefix to be either the empty string or end with a '.', so that expanded keys read naturally (e.g. \"reindex.ssl.\" + \"verification_mode\"). A non-empty prefix without the trailing dot would silently produce malformed setting keys.","triggerScenarios":"Instantiating new SslConfigurationLoader(\"reindex.ssl\") or any prefix missing the trailing dot. Common when building a loader programmatically rather than from elasticsearch.yml.","commonSituations":"Custom plugin code constructing a loader; copy-paste from settings keys that omit the dot; passing a Java constant that was trimmed.","solutions":["Append '.' to the prefix: new SslConfigurationLoader(\"reindex.ssl.\").","Use the empty string for the top-level/default SSL config.","Centralise prefix constants in one place so they always end in '.'."],"exampleFix":"// before\nnew SslConfigurationLoader(\"reindex.ssl\");\n// after\nnew SslConfigurationLoader(\"reindex.ssl.\");","handlingStrategy":"validation","validationCode":"String normalisePrefix(String p) {\n    if (p == null || p.isEmpty()) return \"\";\n    return p.endsWith(\".\") ? p : p + \".\";\n}\n// then: new SslConfigurationLoader(normalisePrefix(rawPrefix));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep prefix constants in one place and always include the trailing dot.","Add a unit test that constructs the loader for every prefix constant you define.","Document the rule on the SslConfigurationLoader constructor Javadoc near the constant."],"tags":["ssl","config","validation","api-misuse"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}