{"record":{"id":"7718d387c7d59794","repo":"prestodb/presto","slug":"prometheus-secure-communication-error","errorCode":"PROMETHEUS_SECURE_COMMUNICATION_ERROR","errorMessage":"An SSL handshake error occurred while establishing a secure connection. Try the following measures to resolve the error:\n\n- Upload a valid SSL certificate for authentication\n- Verify the expiration status of the uploaded certificate.\n- If you are connecting with SSL, enable SSL on both ends of the connection.\n","messagePattern":"An SSL handshake error occurred while establishing a secure connection\\. Try the following measures to resolve the error:\n\n- Upload a valid SSL certificate for authentication\n- Verify the expiration status of the uploaded certificate\\.\n- If you are connecting with SSL, enable SSL on both ends of the connection\\.\n","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-prometheus/src/main/java/com/facebook/presto/plugin/prometheus/PrometheusClient.java","lineNumber":194,"sourceCode":"                else {\n                    httpClient = new OkHttpClient.Builder()\n                            .sslSocketFactory(getSSLContext().getSocketFactory(), (X509TrustManager) getTrustManagerFactory().getTrustManagers()[0])\n                            .build();\n                }\n                response = httpClient.newCall(requestBuilder.build()).execute();\n                if (response.isSuccessful() && response.body() != null) {\n                    return response.body().bytes();\n                }\n            }\n            else {\n                response = httpClient.newCall(requestBuilder.build()).execute();\n                if (response.isSuccessful() && response.body() != null) {\n                    return response.body().bytes();\n                }\n            }\n        }\n        catch (SSLHandshakeException e) {\n            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, \"An SSL handshake error occurred while establishing a secure connection. Try the following measures to resolve the error:\\n\\n\" + \"- Upload a valid SSL certificate for authentication\\n- Verify the expiration status of the uploaded certificate.\\n- If you are connecting with SSL, enable SSL on both ends of the connection.\\n\", e);\n        }\n        catch (SSLPeerUnverifiedException e) {\n            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, \"Peer verification failed. These measures might resolve the issue \\n\" +\n                    \"- Add correct Hostname in the SSL certificate's SAN list \\n\" +\n                    \"- The certificate chain might be incomplete. Check your SSL certificate\\n\", e);\n        }\n        catch (IOException e) {\n            throw new PrestoException(PROMETHEUS_UNKNOWN_ERROR, \"Error reading metrics\", e);\n        }\n        catch (NoSuchAlgorithmException e) {\n            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, \"Requested cryptographic algorithm is not available\", e);\n        }\n        catch (KeyStoreException e) {\n            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, \"Keystore operation error\", e);\n        }\n        catch (KeyManagementException e) {\n            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, \"Key management operation error\", e);\n        }","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-prometheus/src/main/java/com/facebook/presto/plugin/prometheus/PrometheusClient.java#L176-L212","documentation":"The Prometheus connector's fetchUri catches SSLHandshakeException while reading the Prometheus HTTP API response and rethrows it as a PrestoException with code PROMETHEUS_SECURE_COMMUNICATION_ERROR. It means the TLS handshake with the Prometheus server failed — the connection could not be secured before any data was exchanged. This is thrown only when SSL/TLS is in play; plain-HTTP IO failures take a different path.","triggerScenarios":"Calling fetchUri (via fetchMetrics or PrometheusRecordSet) against an https:// Prometheus URI when the server's certificate is expired, self-signed, untrusted by the JVM truststore, or the server does not actually support SSL on that port.","commonSituations":"Prometheus fronted by a proxy/load balancer with an expired or self-signed cert; TLS enabled on the client but plain HTTP on the server port (or vice versa); corporate proxy doing TLS interception; JVMcacerts missing the private CA.","solutions":["Verify the Prometheus server's certificate with a browser or `openssl s_client -connect host:port -servername host` and renew it if expired","If using a custom truststore, add the server's CA certificate to it (keytool -importcert) and point presto-prometheus.properties prometheus.trust-certificate at it","Ensure SSL is enabled on both ends — the connector's URI scheme (https) must match the server's actual TLS configuration","Import the corporate CA into the JVM cacerts used by the Presto coordinator if TLS interception is in play"],"exampleFix":"// before (self-signed cert rejected)\nconnection-url=https://prometheus.example.com:9090\n// after: provide truststore config\nprometheus.trust-certificate=/etc/presto/prometheus.truststore\nprometheus.truststore.password=changeit","handlingStrategy":"try-catch","validationCode":"// Verify TLS reachability and cert validity before configuring\nopenssl s_client -connect prometheus.example.com:9090 -servername prometheus.example.com 2>/dev/null | openssl x509 -noout -dates -subject","typeGuard":null,"tryCatchPattern":"try { result = queryPrometheus(); } catch (PrestoException e) {\n  if (PROMETHEUS_SECURE_COMMUNICATION_ERROR.equals(e.getErrorCode().getName())) {\n    // inspect certificate/truststore, then retry after fix\n  } else throw e;\n}","preventionTips":["Always use a CA-signed certificate with valid SANs on the Prometheus endpoint","Keep prometheus.trust-certificate in sync with the server's CA and renew before expiry","Test https reachability with curl/openssl whenever the connection-url changes","Enable SSL on both ends — match the URI scheme to the server's TLS config"],"tags":["ssl","tls","network","prometheus"],"backgroundTag":"ssl-handshake-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}