{"record":{"id":"64473c2045975730","repo":"prestodb/presto","slug":"failed-to-load-truststore","errorCode":null,"errorMessage":"Failed to load truststore","messagePattern":"Failed to load truststore","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java","lineNumber":169,"sourceCode":"    {\n        if (redisConnectorConfig.getTruststorePath() == null) {\n            log.info(\"No truststore path configured, skipping TLS truststore loading\");\n            return null;\n        }\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n            try (InputStream in = Files.newInputStream(redisConnectorConfig.getTruststorePath().toPath())) {\n                trustStore.load(null, null);\n                CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n                X509Certificate cert = (X509Certificate) cf.generateCertificate(in);\n                trustStore.setCertificateEntry(\"redis-server\", cert);\n            }\n            log.info(\"Loaded truststore from %s\", redisConnectorConfig.getTruststorePath());\n            return trustStore;\n        }\n        catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException e) {\n            throw new RuntimeException(\"Failed to load truststore\", e);\n        }\n    }\n\n    private JedisPool buildJedisPool(HostAddress host, boolean useTls, SSLContext sslContext)\n    {\n        log.info(\"Creating new %s JedisPool for %s\", useTls ? \"TLS\" : \"non-TLS\", host);\n\n        return new JedisPool(\n                jedisPoolConfig,\n                host.getHostText(),\n                host.getPort(),\n                toIntExact(redisConnectorConfig.getRedisConnectTimeout().toMillis()),\n                JEDIS_SO_TIMEOUT,\n                JEDIS_CONN_TIMEOUT,\n                redisConnectorConfig.getRedisUser(),\n                redisConnectorConfig.getRedisPassword(),\n                redisConnectorConfig.getRedisDataBaseIndex(),\n                null,","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java#L151-L187","documentation":"loadTrustStore reads the configured truststore file and imports the Redis server certificate(s) into a KeyStore. KeyStoreException, IOException, CertificateException, or NoSuchAlgorithmException during loading are wrapped in a RuntimeException 'Failed to load truststore'. It means the truststore file could not be read or parsed as a keystore/certificate.","triggerScenarios":"redis.truststore-path points to a nonexistent or unreadable file (IOException); the file is not a valid keystore format or is password-protected without redis.truststore-password (KeyStoreException/CertificateException); certificate is malformed.","commonSituations":"Wrong path in config (typo, container image missing the file); wrong file type (PEM passed where JKS expected, or vice versa depending on loader); permissions denied under the Presto service user; file mounted but empty.","solutions":["Fix redis.truststore-path to point at an existing, readable keystore file","Set redis.truststore-password if the truststore is password protected","Regenerate or re-export the truststore in the correct format (e.g. keytool -importcert) and verify with keytool -list","Ensure the file is readable by the user running Presto (chown/chmod) and mounted into containers"],"exampleFix":"// before\nredis.truststore-path=/wrong/dir/truststore.jks\n// after\nredis.truststore-path=/etc/presto/redis/truststore.jks\nredis.truststore-password=changeit","handlingStrategy":"validation","validationCode":"File f = new File(truststorePath);\nif (!f.isFile() || !f.canRead()) {\n    throw new IllegalArgumentException(\"truststore not readable: \" + truststorePath);\n}","typeGuard":null,"tryCatchPattern":"try { KeyStore ts = loadTrustStore(); } catch (RuntimeException e) { throw new IllegalStateException(\"truststore load failed: \" + e.getCause(), e.getCause()); }","preventionTips":["Verify truststore path and permissions before deployment","Confirm the file format matches what the loader expects","Mount the truststore into containers and set password if protected"],"tags":["redis","tls","ssl","keystore","io"],"backgroundTag":"truststore-load-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}