{"record":{"id":"5e1583d6416b1442","repo":"pentaho/pentaho-kettle","slug":"kettletrustmanager-exception","errorCode":"KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager","errorMessage":"KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager","messagePattern":"KettleTrustManager\\.Exception\\.CouldNotInitializeKettleTrustManager","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java","lineNumber":89,"sourceCode":"              PKG, \"KettleTrustManager.Exception.CouldNotOpenCertStore\" ), e );\n          }\n        }\n      }\n\n      // Now initialize the trust manager...\n      //\n      try {\n        TrustManagerFactory tmf = null;\n        tmf = TrustManagerFactory.getInstance( \"SunX509\" );\n        tmf.init( keyStore );\n        TrustManager[] tms = tmf.getTrustManagers();\n        tm = (X509TrustManager) tms[0];\n      } catch ( Exception e ) {\n        throw new KettleException( BaseMessages.getString(\n          PKG, \"KettleTrustManager.Exception.CouldNotInitializeTrustManager\" ), e );\n      }\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString(\n        PKG, \"KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager\" ), e );\n    }\n  }\n\n  /**\n   * Pass method from x509TrustManager to this class...\n   *\n   * @return an array of certificate authority certificates which are trusted for authenticating peers\n   */\n  public X509Certificate[] getAcceptedIssuers() {\n    if ( tm == null ) {\n      return null;\n    }\n    return tm.getAcceptedIssuers();\n  }\n\n  /**\n   * Pass method from x509TrustManager to this class...","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java#L71-L107","documentation":"Outer wrapper exception in the KettleTrustManager constructor: any Exception during the whole trust-manager initialization (including the inner CouldNotInitializeTrustManager path) is rethrown with this message. It signals the custom trust manager object could not be constructed at all, so the LDAPS socket factory cannot be configured.","triggerScenarios":"Any exception escaping the outer try in the constructor — keyStore load failures are handled separately, so this typically wraps TrustManagerFactory setup or cast errors (tms[0] not an X509TrustManager).","commonSituations":"Same root causes as trust manager init failure: empty/invalid keystore, missing SunX509 algorithm, broken JVM security providers; also ClassCastException when the first trust manager is not X509.","solutions":["Look at the cause chain to find whether init or the cast failed","Populate the keystore with the server certificate (keytool -importcert)","Confirm the JVM supports SunX509 TrustManagerFactory","Replace an empty/corrupt truststore file and retry the LDAPS connection"],"exampleFix":"// before\nKettleTrustManager with empty or corrupt truststore -> init fails\n// after\nkeytool -importcert -alias ldap -file ldapserver.crt -keystore truststore.jks -storepass changeit\n// reconfigure the step to point at truststore.jks","handlingStrategy":"try-catch","validationCode":"KeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (FileInputStream in = new FileInputStream(ksFile)) { ks.load(in, pwd.toCharArray()); }\nif (ks.size() == 0) throw new IllegalStateException(\"Empty truststore: import the LDAP server certificate first\");","typeGuard":null,"tryCatchPattern":"try {\n  configureTrustStore(ksFile, pwd);\n} catch (KettleException e) {\n  log.error(\"KettleTrustManager init failed; cause chain:\", e); // walk to root cause\n  throw new IllegalStateException(\"LDAPS setup failed: \" + e.getCause(), e.getCause());\n}","preventionTips":["Always populate the truststore with the server cert (keytool -importcert -noprompt)","Test LDAPS connectivity outside Pentaho first (openssl s_client -connect host:636)","Regenerate corrupt truststore files rather than editing them"],"tags":["ldap","ssl","trust-manager"],"backgroundTag":"module-init-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}