{"record":{"id":"5fd4865801f89d55","repo":"testcontainers/testcontainers-java","slug":"elasticsearch-ca-certificate-cannot-be-empty","errorCode":null,"errorMessage":"Elasticsearch CA certificate cannot be empty","messagePattern":"Elasticsearch CA certificate cannot be empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":255,"sourceCode":"        }\n\n        if (!token.equals(token.trim())) {\n            throw new IllegalArgumentException(\"Service token cannot have leading or trailing whitespace\");\n        }\n        this.elasticsearchServiceAccountToken = token;\n        return this;\n    }\n\n    /**\n     * Configures the Elasticsearch CA certificate for HTTPS connections.\n     *\n     * @param caCertificate the CA certificate in PEM format\n     * @return this container instance\n     * @throws IllegalArgumentException if certificate is empty\n     */\n    public KibanaContainer withElasticsearchCaCertificate(byte[] caCertificate) {\n        if (caCertificate == null || caCertificate.length == 0) {\n            throw new IllegalArgumentException(\"Elasticsearch CA certificate cannot be empty\");\n        }\n        this.elasticsearchCaCertificate = caCertificate;\n        return this;\n    }\n\n    @Override\n    protected void configure() {\n        super.configure();\n\n        addEnv(\"XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY\", encryptionKey);\n        addEnv(\"SERVER_NAME\", \"kibana\");\n\n        if (elasticsearchCaCertificate != null) {\n            withCopyToContainer(Transferable.of(elasticsearchCaCertificate), ES_CA_CERT_PATH);\n            addEnv(\"ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES\", ES_CA_CERT_PATH);\n        }\n        if (elasticsearch != null) {\n            configureManagedElasticsearch();","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L237-L273","documentation":"Thrown by withElasticsearchCaCertificate when the CA certificate byte array is null or zero-length. In HTTPS-managed mode Kibana needs Elasticsearch's HTTP CA (in PEM format) to trust the Elasticsearch TLS certificate, and an empty array would produce an unusable truststore.","triggerScenarios":"Calling withElasticsearchCaCertificate(null) or withElasticsearchCaCertificate(new byte[0]); also when copying cert bytes from a file/container that failed silently and returned an empty array.","commonSituations":"Reading the CA file from a path that resolves to an empty file; an earlier copyFileFromContainer call that returned empty bytes; wiring TLS config conditionally and passing an uninitialized byte[].","solutions":["Pass the actual PEM-encoded HTTP CA bytes from the Elasticsearch container (e.g. elasticsearch.copyFileFromContainer(es.getCertPath(), IOUtils::toByteArray)).","Check the CA file on disk is non-empty before reading it.","If Elasticsearch is not running HTTPS, remove the CA configuration instead of passing an empty array."],"exampleFix":"// before\nbyte[] ca = Files.readAllBytes(Path.of(caFile));\ncontainer.withElasticsearchCaCertificate(ca);\n// after\nbyte[] ca = Files.readAllBytes(Path.of(caFile));\nif (ca.length == 0) throw new IllegalStateException(\"CA file \" + caFile + \" is empty\");\ncontainer.withElasticsearchCaCertificate(ca);","handlingStrategy":"validation","validationCode":"if (caCert == null || caCert.length == 0) throw new IllegalStateException(\"Elasticsearch HTTP CA must be non-empty PEM bytes\");\ncontainer.withElasticsearchCaCertificate(caCert);","typeGuard":"boolean isValidPem(byte[] cert) { return cert != null && cert.length > 0 && new String(cert, StandardCharsets.US_ASCII).contains(\"BEGIN CERTIFICATE\"); }","tryCatchPattern":"try { container.withElasticsearchCaCertificate(ca); } catch (IllegalArgumentException e) { throw new IllegalStateException(\"CA cert for Elasticsearch is empty — check TLS setup\", e); }","preventionTips":["Read the CA directly from the ES container with copyFileFromContainer instead of hand-managed files","Assert PEM content (BEGIN CERTIFICATE marker) before configuring TLS","Only call withElasticsearchCaCertificate when Elasticsearch actually runs HTTPS"],"tags":["validation","elasticsearch","tls","testcontainers","empty-argument"],"backgroundTag":"empty-required-field","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}