{"record":{"id":"59bd208b9a45fa48","repo":"grpc/grpc-java","slug":"native-x509-trustmanager-not-found","errorCode":null,"errorMessage":"Native X509 TrustManager not found.","messagePattern":"Native X509 TrustManager not found\\.","errorType":"exception","errorClass":"CertStoreException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/internal/security/trust/XdsTrustManagerFactory.java","lineNumber":182,"sourceCode":"        i++;\n      }\n      tmf.init(ks);\n    } catch (NoSuchAlgorithmException | KeyStoreException | IOException | CertificateException e) {\n      logger.log(Level.SEVERE, \"createX509TrustManager\", e);\n      throw new CertStoreException(e);\n    }\n    TrustManager[] tms = tmf.getTrustManagers();\n    X509ExtendedTrustManager myDelegate = null;\n    if (tms != null) {\n      for (TrustManager tm : tms) {\n        if (tm instanceof X509ExtendedTrustManager) {\n          myDelegate = (X509ExtendedTrustManager) tm;\n          break;\n        }\n      }\n    }\n    if (myDelegate == null) {\n      throw new CertStoreException(\"Native X509 TrustManager not found.\");\n    }\n    return myDelegate;\n  }\n\n  @Override\n  protected void engineInit(KeyStore keyStore) throws Exception {\n    throw new UnsupportedOperationException();\n  }\n\n  @Override\n  protected void engineInit(ManagerFactoryParameters managerFactoryParameters) throws Exception {\n    throw new UnsupportedOperationException();\n  }\n\n  @Override\n  protected TrustManager[] engineGetTrustManagers() {\n    return new TrustManager[] {xdsX509TrustManager};\n  }","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/internal/security/trust/XdsTrustManagerFactory.java#L164-L200","documentation":"Inside XdsTrustManagerFactory's custom TrustManager engine, createTrustManager picks a default X509ExtendedTrustManager from the JVM's default trust manager list and casts it for delegation. If no element of the returned default trust managers is an X509ExtendedTrustManager, it throws CertStoreException('Native X509 TrustManager not found.'), meaning the runtime environment lacks the expected native trust manager implementation.","triggerScenarios":"engineInit initializing with default JVM trust store when TrustManagerFactory.getDefaultAlgorithm() returns a factory whose getTrustManagers() contains no X509ExtendedTrustManager instance — e.g. unusual JCE provider ordering, custom security providers, or non-standard JDKs/Android runtimes.","commonSituations":"Running on a JRE with a custom TrustManagerFactory provider replacing the default; minimal/embedded JVMs without the standard SunJSSE extended trust manager; classpath security provider overrides.","solutions":["Check TrustManagerFactory.getDefaultAlgorithm() and the installed security providers; remove/reorder providers that shadow the standard X509ExtendedTrustManager","Run on a standard JDK/JRE that exposes X509ExtendedTrustManager from the default trust manager factory","Explicitly configure the algorithm (ssl.TrustManagerFactory.algorithm=PKIX / SunX509) in java.security so the default TM is the extended one","Provide your own trust manager wiring instead of relying on the default if the environment cannot be changed"],"exampleFix":"// before: security.provider.1=com.example.CustomProvider (returns plain X509TrustManager)\n// after: keep default providers first, custom ones later\nsecurity.provider.1=sun.security.provider.Sun\nsecurity.provider.2=com.example.CustomProvider","handlingStrategy":"try-catch","validationCode":"// Detect the problem early at startup\nfor (TrustManager tm : TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).getTrustManagers()) {\n  if (tm instanceof X509ExtendedTrustManager) return; // ok\n}\nthrow new IllegalStateException(\"No X509ExtendedTrustManager in default trust managers; xDS TLS will fail\");","typeGuard":"static boolean hasExtendedTrustManager(TrustManager[] tms) {\n  for (TrustManager tm : tms) if (tm instanceof X509ExtendedTrustManager) return true;\n  return false;\n}","tryCatchPattern":"try {\n  engineInit();\n} catch (CertStoreException e) {\n  if (\"Native X509 TrustManager not found.\".equals(e.getMessage())) {\n    logger.error(\"Default trust managers lack X509ExtendedTrustManager; check security providers/JVM\", e);\n  }\n  throw e;\n}","preventionTips":["Run on a standard JDK exposing X509ExtendedTrustManager via the default algorithm","Avoid security providers that shadow the default TrustManagerFactory implementation","Smoke-test TLS handshake at boot in constrained JVMs/embedded runtimes"],"tags":["xds","tls","jvm","trust-manager"],"backgroundTag":"internal-invariant-violation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}