{"record":{"id":"6096a8b49bfe5cd6","repo":"elastic/elasticsearch","slug":"failed-to-initialize-a-trustmanager-for-the-system","errorCode":null,"errorMessage":"failed to initialize a TrustManager for the system keystore","messagePattern":"failed to initialize a TrustManager for the system keystore","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"critical","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DefaultJdkTrustConfig.java","lineNumber":68,"sourceCode":"    /**\n     * @param trustStorePassword the password for the truststore. It applies only when PKCS#11 tokens are used, is null otherwise\n     */\n    DefaultJdkTrustConfig(BiFunction<String, String, String> systemProperties, @Nullable char[] trustStorePassword) {\n        this.systemProperties = systemProperties;\n        this.trustStorePassword = trustStorePassword;\n    }\n\n    @Override\n    public boolean isSystemDefault() {\n        return true;\n    }\n\n    @Override\n    public X509ExtendedTrustManager createTrustManager() {\n        try {\n            return KeyStoreUtil.createTrustManager(getSystemTrustStore(), TrustManagerFactory.getDefaultAlgorithm());\n        } catch (GeneralSecurityException e) {\n            throw new SslConfigException(\"failed to initialize a TrustManager for the system keystore\", e);\n        }\n    }\n\n    /**\n     * When a PKCS#11 token is used as the system default keystore/truststore, we need to pass the keystore\n     * password when loading, even for reading certificates only ( as opposed to i.e. JKS keystores where\n     * we only need to pass the password for reading Private Key entries ).\n     *\n     * @return the KeyStore used as truststore for PKCS#11 initialized with the password, null otherwise\n     */\n    private KeyStore getSystemTrustStore() {\n        if (isPkcs11Truststore(systemProperties) && trustStorePassword != null) {\n            try {\n                KeyStore keyStore = KeyStore.getInstance(\"PKCS11\");\n                keyStore.load(null, trustStorePassword);\n                return keyStore;\n            } catch (GeneralSecurityException | IOException e) {\n                throw new SslConfigException(\"failed to load the system PKCS#11 truststore\", e);","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DefaultJdkTrustConfig.java#L50-L86","documentation":"Thrown as SslConfigException by DefaultJdkTrustConfig.createTrustManager when the JVM's default/system trust store cannot be loaded or when TrustManagerFactory.init() fails. DefaultJdkTrustConfig wraps the JDK's built-in CA trust store (typically the cacerts file). The underlying GeneralSecurityException is attached as the cause.","triggerScenarios":"Calling createTrustManager() on a DefaultJdkTrustConfig instance when KeyStoreUtil.createTrustManager(getSystemTrustStore(), TrustManagerFactory.getDefaultAlgorithm()) throws a GeneralSecurityException.","commonSituations":"The JDK's cacerts file is corrupted, missing, or has restrictive file permissions. A custom javax.net.ssl.trustStore system property points to a non-existent or invalid file. The default TrustManagerFactory algorithm is unavailable (rare, custom security providers). Common when running in a minimal container image that lacks the default CA bundle.","solutions":["Check the exception cause: a FileNotFoundException or NoSuchAlgorithmException narrows the problem.","Verify the JDK cacerts file exists and is readable: ls -la $JAVA_HOME/lib/security/cacerts.","If using a custom javax.net.ssl.trustStore, validate the file path and format with keytool -list -keystore <path>.","In containers, ensure the CA certificates package (ca-certificates) is installed or mount a valid cacerts."],"exampleFix":"// before — system property points to a missing truststore\n-Djavax.net.ssl.trustStore=/nonexistent/truststore.jks\n\n// after — point to a valid truststore or remove the property to use JDK default\n-Djavax.net.ssl.trustStore=/valid/path/cacerts\n// or simply omit the property and rely on $JAVA_HOME/lib/security/cacerts","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    X509ExtendedTrustManager tm = defaultJdkTrustConfig.createTrustManager();\n} catch (SslConfigException e) {\n    // check e.getCause() for KeyStoreException / NoSuchAlgorithmException / CertificateException\n    log.error(\"System trust store unavailable: {}\", e.getMessage(), e.getCause());\n    // verify $JAVA_HOME/lib/security/cacerts exists and is readable\n}","preventionTips":["Verify $JAVA_HOME/lib/security/cacerts exists and is readable in the runtime environment.","If overriding with javax.net.ssl.trustStore, validate the path and format first.","In containers, ensure ca-certificates or a valid cacerts is installed."],"tags":["ssl","tls","trust-store","jdk","security","elasticsearch","configuration"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}