{"record":{"id":"764562d1a1d63bc9","repo":"elastic/elasticsearch","slug":"no-cipher-suites-configured-in","errorCode":null,"errorMessage":"no cipher suites configured in [{}]","messagePattern":"no cipher suites configured in \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":322,"sourceCode":"        final List<X509Field> trustRestrictionsX509Fields = resolveListSetting(\n            TRUST_RESTRICTIONS_X509_FIELDS,\n            X509Field::parseForRestrictedTrust,\n            defaultRestrictedTrustFields\n        );\n        final long handshakeTimeoutMillis = resolveSetting(\n            HANDSHAKE_TIMEOUT,\n            s -> TimeValue.parseTimeValue(s, HANDSHAKE_TIMEOUT),\n            DEFAULT_HANDSHAKE_TIMEOUT\n        ).millis();\n\n        final SslKeyConfig keyConfig = buildKeyConfig(basePath);\n        final SslTrustConfig trustConfig = buildTrustConfig(basePath, verificationMode, keyConfig, Set.copyOf(trustRestrictionsX509Fields));\n\n        if (protocols == null || protocols.isEmpty()) {\n            throw new SslConfigException(\"no protocols configured in [\" + settingPrefix + PROTOCOLS + \"]\");\n        }\n        if (ciphers == null || ciphers.isEmpty()) {\n            throw new SslConfigException(\"no cipher suites configured in [\" + settingPrefix + CIPHERS + \"]\");\n        }\n        final boolean isExplicitlyConfigured = hasSettings(settingPrefix);\n        return new SslConfiguration(\n            settingPrefix,\n            isExplicitlyConfigured,\n            trustConfig,\n            keyConfig,\n            verificationMode,\n            clientAuth,\n            ciphers,\n            protocols,\n            handshakeTimeoutMillis\n        );\n    }\n\n    protected SslTrustConfig buildTrustConfig(\n        Path basePath,\n        SslVerificationMode verificationMode,","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L304-L340","documentation":"Sibling of 829 for ciphers: after resolving ssl.cipher_suites (with defaults), the loader requires a non-null non-empty list. The error message names the exact setting key (prefix + \"cipher_suites\").","triggerScenarios":"ssl.cipher_suites is explicitly set to an empty list, or a custom loader nulls out DEFAULT_CIPHERS.","commonSituations":"Operator sets cipher_suites: [] intending to use 'all' ciphers; templated config that conditionally renders an empty list; misunderstanding that an empty value is not the same as 'use defaults'.","solutions":["Remove the empty cipher_suites setting so DEFAULT_CIPHERS applies.","Populate the list with at least one strong cipher suite recognised by the JVM.","Cross-check cipher names against the JVM's supported suites: SSLSocket.getSupportedCipherSuites()."],"exampleFix":"# before\nxpack.security.http.ssl.cipher_suites: []\n# after (omit, or set explicitly)\nxpack.security.http.ssl.cipher_suites: [ \"TLS_AES_256_GCM_SHA384\", \"TLS_AES_128_GCM_SHA256\" ]","handlingStrategy":"validation","validationCode":"List<String> resolveCiphersSafely(SslConfigurationLoader loader) {\n    List<String> c = loader.resolveListSetting(\"cipher_suites\", Function.identity(), SslConfigurationLoader.DEFAULT_CIPHERS);\n    if (c == null || c.isEmpty()) return SslConfigurationLoader.DEFAULT_CIPHERS;\n    return c;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never set cipher_suites to an empty list; omit it to use defaults.","Lint rendered config for empty arrays under ssl.*.","Cross-check any explicit cipher name against the JVM's supported list in CI."],"tags":["ssl","config","ciphers","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}