{"record":{"id":"7642d835500493d5","repo":"elastic/elasticsearch","slug":"could-not-create-the-default-ssl-context","errorCode":null,"errorMessage":"could not create the default ssl context","messagePattern":"could not create the default ssl context","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"client/rest/src/main/java/org/elasticsearch/client/RestClientBuilder.java","lineNumber":340,"sourceCode":"        }\n\n        try {\n            HttpAsyncClientBuilder httpClientBuilder = HttpAsyncClientBuilder.create()\n                .setDefaultRequestConfig(requestConfigBuilder.build())\n                // default settings for connection pooling may be too constraining\n                .setMaxConnPerRoute(DEFAULT_MAX_CONN_PER_ROUTE)\n                .setMaxConnTotal(DEFAULT_MAX_CONN_TOTAL)\n                .setSSLContext(SSLContext.getDefault())\n                .setUserAgent(USER_AGENT_HEADER_VALUE)\n                .setTargetAuthenticationStrategy(new PersistentCredentialsAuthenticationStrategy())\n                .setThreadFactory(new RestClientThreadFactory());\n            if (httpClientConfigCallback != null) {\n                httpClientBuilder = httpClientConfigCallback.customizeHttpClient(httpClientBuilder);\n            }\n\n            return httpClientBuilder.build();\n        } catch (NoSuchAlgorithmException e) {\n            throw new IllegalStateException(\"could not create the default ssl context\", e);\n        }\n    }\n\n    /**\n     * Callback used the default {@link RequestConfig} being set to the {@link CloseableHttpClient}\n     * @see HttpClientBuilder#setDefaultRequestConfig\n     */\n    public interface RequestConfigCallback {\n        /**\n         * Allows to customize the {@link RequestConfig} that will be used with each request.\n         * It is common to customize the different timeout values through this method without losing any other useful default\n         * value that the {@link RestClientBuilder} internally sets.\n         */\n        RequestConfig.Builder customizeRequestConfig(RequestConfig.Builder requestConfigBuilder);\n    }\n\n    /**\n     * Callback used to customize the {@link CloseableHttpClient} instance used by a {@link RestClient} instance.","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/client/rest/src/main/java/org/elasticsearch/client/RestClientBuilder.java#L322-L358","documentation":"Thrown when the default SSLContext cannot be obtained during HttpClient creation: SSLContext.getDefault() raised NoSuchAlgorithmException, meaning the JVM has no usable TLS provider. The original exception is chained. The client cannot initialise secure connections, so startup fails.","triggerScenarios":"Building a RestClient for https endpoints on a JVM where the default TLS algorithm is unavailable or disabled via java.security properties.","commonSituations":"Custom JRE / minimal runtime with SSL providers removed; overly restrictive java.security (ssl.SocketFactory.provider removed); broken JDK install; running on a stripped container image.","solutions":["Run on a standard JDK distribution where SunJSSE is present.","Inspect $JAVA_HOME/conf/security/java.security for removed/disabled TLS providers and restore them.","If a custom SSLContext is required, supply it via httpClientBuilder callback (setSSLContext) instead of relying on the default.","Verify with: keytool -list or a trivial SSLContext.getInstance(\"TLS\") test."],"exampleFix":"// before\nRestClient.builder(new HttpHost(\"https\", \"es\", 9200)).build(); // default SSLContext fails\n// after\nSSLContext ctx = SSLContext.getInstance(\"TLS\");\nctx.init(null, null, null);\nRestClient.builder(new HttpHost(\"https\", \"es\", 9200))\n    .setHttpClientConfigCallback(b -> b.setSSLContext(ctx))\n    .build();","handlingStrategy":"fallback","validationCode":"SSLContext ctx;\ntry { ctx = SSLContext.getDefault(); }\ncatch (NoSuchAlgorithmException e) { ctx = SSLContext.getInstance(\"TLS\"); ctx.init(null, null, null); }","typeGuard":null,"tryCatchPattern":"try { RestClient.builder(httpsHost).build(); }\ncatch (IllegalStateException e) {\n    if (e.getMessage().equals(\"could not create the default ssl context\")) {\n        // supply explicit SSLContext via httpClientConfigCallback and retry\n    } else throw e;\n}","preventionTips":["Pin a supported JDK image with SunJSSE in your container/Dockerfile.","Provide an explicit SSLContext via the httpClientBuilder callback in production."],"tags":["rest-client","ssl","tls","jvm","configuration"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T11:17:21.771Z"}