{"record":{"id":"8795f4ebe8cc032e","repo":"prestodb/presto","slug":"failed-to-verify-truststore-contents","errorCode":null,"errorMessage":"Failed to verify truststore contents","messagePattern":"Failed to verify truststore contents","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":258,"sourceCode":"            catch (IOException | GeneralSecurityException e) {\n                log.debug(\"Failed to load truststore as JKS format: {}\", e.getMessage());\n                throw new GeneralSecurityException(\n                        \"Failed to load truststore as both PEM and KeyStore format. \" +\n                                \"PEM error: \" + (lastException != null ? lastException.getMessage() : \"unknown\") +\n                                \", KeyStore error: \" + e.getMessage(), e);\n            }\n        }\n\n        // Verify the truststore is not empty\n        try {\n            List<String> aliases = Collections.list(trustStore.aliases());\n            if (aliases.isEmpty()) {\n                throw new GeneralSecurityException(\"Loaded truststore is empty - no certificates found in: \" + trustStorePath);\n            }\n            log.debug(\"Truststore loaded with {} certificate(s)\", aliases.size());\n        }\n        catch (KeyStoreException e) {\n            throw new GeneralSecurityException(\"Failed to verify truststore contents\", e);\n        }\n\n        return trustStore;\n    }\n\n    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException\n    {\n        for (String alias : list(keyStore.aliases())) {\n            if (!keyStore.isKeyEntry(alias)) {\n                continue;\n            }\n\n            Certificate certificate = keyStore.getCertificate(alias);\n            if (!(certificate instanceof X509Certificate)) {\n                continue;\n            }\n\n            try {","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L240-L276","documentation":"While verifying the loaded truststore's aliases, the alias enumeration itself can throw KeyStoreException (the keystore is in an unreadable/unloaded state). loadTrustStore wraps that in a GeneralSecurityException with message \"Failed to verify truststore contents\", keeping the original KeyStoreException as the cause.","triggerScenarios":"loadTrustStore's try block calls trustStore.aliases() on a KeyStore whose provider/state makes enumeration fail — rare, usually a corrupted store or a KeyStore instance that was not properly loaded.","commonSituations":"Corrupted truststore file (partial write, wrong password tolerated by some formats), a custom KeyStore provider misbehaving, or concurrency where the store is reloaded mid-verification.","solutions":["Inspect the cause (KeyStoreException) in the stack trace to find the underlying keystore failure","Re-create the truststore with keytool and retry with a known-good file","Confirm the password and file format (JKS vs PKCS12) match what was passed to KeyStore.getInstance/load","Upgrade/verify the JCE provider if a non-default KeyStore provider is configured"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"java\nKeyStore ks = KeyStore.getInstance(type);\ntry (InputStream in = Files.newInputStream(path)) { ks.load(in, password); }\nks.size(); // forces enumeration; surfaces KeyStoreException early","typeGuard":null,"tryCatchPattern":"java\ntry {\n    sslContext = provider.createSSLContext(config);\n} catch (GeneralSecurityException e) {\n    Throwable cause = e.getCause();\n    if (cause instanceof KeyStoreException) {\n        log.error(\"Corrupt/unloadable truststore: \" + cause.getMessage());\n    }\n    throw e;\n}","preventionTips":["Validate truststore integrity with keytool -list after every rotation","Write truststore files atomically (temp file + rename) to avoid partial writes","Pin and test the KeyStore provider/version in your build"],"tags":["ssl","truststore","keystore","security"],"backgroundTag":"keystore-load-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}