{"record":{"id":"64fd406ddb89dffc","repo":"elastic/elasticsearch","slug":"74-64fd40","errorCode":"74","errorMessage":"Error creating the elasticsearch keystore.","messagePattern":"Error creating the elasticsearch keystore\\.","errorType":"exception","errorClass":"UserException","httpStatus":null,"severity":"error","filePath":"distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/CreateKeyStoreCommand.java","lineNumber":54,"sourceCode":"        super(\"Creates a new elasticsearch keystore\");\n        this.passwordOption = parser.acceptsAll(Arrays.asList(\"p\", \"password\"), \"Prompt for password to encrypt the keystore\");\n    }\n\n    @Override\n    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {\n        try (SecureString password = options.has(passwordOption) ? readPassword(terminal, true) : new SecureString(new char[0])) {\n            Path keystoreFile = KeyStoreWrapper.keystorePath(env.configDir());\n            if (Files.exists(keystoreFile)) {\n                if (terminal.promptYesNo(\"An elasticsearch keystore already exists. Overwrite?\", false) == false) {\n                    terminal.println(\"Exiting without creating keystore.\");\n                    return;\n                }\n            }\n            KeyStoreWrapper keystore = KeyStoreWrapper.create();\n            keystore.save(env.configDir(), password.getChars());\n            terminal.println(\"Created elasticsearch keystore in \" + KeyStoreWrapper.keystorePath(env.configDir()));\n        } catch (SecurityException e) {\n            throw new UserException(ExitCodes.IO_ERROR, \"Error creating the elasticsearch keystore.\");\n        }\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":58,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/CreateKeyStoreCommand.java#L36-L58","documentation":"Thrown by CreateKeyStoreCommand when `KeyStoreWrapper.create()` + `save(...)` raises a `SecurityException`. Exits IO_ERROR (74). Because create is the bootstrap path, this SecurityException usually reflects a JVM/JCE problem (provider misconfiguration, missing algorithm) rather than a wrong password — there is no prior keystore to decrypt. The command had already prompted to overwrite if the file exists.","triggerScenarios":"Running `create` on a JVM whose security policy or provider list disallows the keystore algorithms; a read-only config directory that prevents writing the new file in a way surfaced as SecurityException; custom security manager blocking the write.","commonSituations":"Hardened/FIPS JVM without the required provider registered; Docker/SELinux denying writes to the config dir; running as a user without write permission on `ES_PATH_CONF`.","solutions":["Check the config directory is writable by the user running the CLI: `touch $ES_PATH_CONF/.write-test`.","Inspect the JVM's security providers / FIPS configuration; ensure BouncyCastle or the default SunJCE provider is available.","Disable or adjust SELinux/AppArmor/capabilities so the process can write `elasticsearch.keystore`.","Look at the full stack trace of the SecurityException to identify the failing operation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"Path dir = env.configDir();\nif (!Files.isWritable(dir)) {\n    throw new IllegalStateException(\"Config dir not writable: \" + dir);\n}","typeGuard":null,"tryCatchPattern":"try {\n    createKeystore();\n} catch (UserException e) {\n    if (e.exitCode == ExitCodes.IO_ERROR) {\n        // inspect underlying SecurityException cause; check providers + permissions\n    }\n}","preventionTips":["Run the CLI as a user with write access to ES_PATH_CONF.","Confirm required JCE providers are registered on hardened/FIPS JVMs.","Disable SELinux/AppArmor denials for the config dir during bootstrap."],"tags":["elasticsearch","keystore-cli","io-error","jvm-security","initialization"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}