{"record":{"id":"8893fa8566d148c6","repo":"elastic/elasticsearch","slug":"cannot-create-trust-using-pem-certificates","errorCode":null,"errorMessage":"cannot create trust using PEM certificates [{}]","messagePattern":"cannot create trust using PEM certificates \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemTrustConfig.java","lineNumber":84,"sourceCode":"        for (String caPath : certificateAuthorities) {\n            for (Certificate cert : readCertificates(List.of(resolveFile(caPath)))) {\n                if (cert instanceof X509Certificate) {\n                    info.add(new StoredCertificate((X509Certificate) cert, caPath, \"PEM\", null, false));\n                }\n            }\n        }\n        return info;\n    }\n\n    @Override\n    public X509ExtendedTrustManager createTrustManager() {\n        final List<Path> paths = resolveFiles();\n        try {\n            final List<Certificate> certificates = readCertificates(paths);\n            final KeyStore store = KeyStoreUtil.buildTrustStore(certificates);\n            return KeyStoreUtil.createTrustManager(store, TrustManagerFactory.getDefaultAlgorithm());\n        } catch (GeneralSecurityException e) {\n            throw new SslConfigException(\"cannot create trust using PEM certificates [\" + SslFileUtil.pathsToString(paths) + \"]\", e);\n        }\n    }\n\n    private List<Path> resolveFiles() {\n        return this.certificateAuthorities.stream().map(this::resolveFile).toList();\n    }\n\n    private Path resolveFile(String other) {\n        return basePath.resolve(other);\n    }\n\n    private List<Certificate> readCertificates(List<Path> paths) {\n        try {\n            return PemUtils.readCertificates(paths);\n        } catch (SecurityException e) {\n            throw SslFileUtil.accessControlFailure(CA_FILE_TYPE, paths, e, basePath);\n        } catch (IOException e) {\n            throw SslFileUtil.ioException(CA_FILE_TYPE, paths, e, null, basePath);","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemTrustConfig.java#L66-L102","documentation":"Thrown by PemTrustConfig.createTrustManager() to wrap any GeneralSecurityException raised while building a TrustManager from a list of PEM certificate-authority files. The exception lists every CA path that was resolved, so the operator can find the offending file.","triggerScenarios":"PemTrustConfig.createTrustManager() resolves certificate-authority paths, calls readCertificates(paths), KeyStoreUtil.buildTrustStore(...), then createTrustManager(...). Any GeneralSecurityException (unparseable cert, empty cert file, cert not X.509, unsupported signature algorithm) is wrapped here.","commonSituations":"CA bundle file contains non-certificate content (e.g. a CSR, a CRL, or a text comment), a PEM file is truncated, a certificate uses a signature algorithm disabled by the JVM (e.g. SHA-1 in restricted mode), or a path points to a directory rather than a file.","solutions":["Validate each CA file individually: `openssl x509 -in ca.pem -noout -text` (should print certificate details).","Inspect the wrapped cause (SslConfigException.getCause()) to identify which file/class of failure.","Ensure each file contains at least one `-----BEGIN CERTIFICATE-----` block.","If a bundle has intermediate + root, split or keep them concatenated — both are supported; just ensure no malformed blocks."],"exampleFix":"# before: trust path points at a CSR by mistake\n# elasticsearch.yml: xpack.security.transport.ssl.certificate_authorities: [\"server.csr\"]\n\n# after: use the real CA cert\nopenssl x509 -in ca.pem -noout -subject  # sanity check\n# configure certificate_authorities: [\"ca.pem\"]","handlingStrategy":"validation","validationCode":"// Validate that every CA file actually contains an X.509 certificate.\npublic static void validateCaBundle(List<Path> paths) throws Exception {\n    CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n    for (Path p : paths) {\n        try (InputStream in = Files.newInputStream(p)) {\n            if (cf.generateCertificates(in).isEmpty()) {\n                throw new IllegalArgumentException(\"no X.509 certificates in \" + p);\n            }\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    return pemTrustConfig.createTrustManager();\n} catch (SslConfigException e) {\n    log.error(\"PEM CA bundle failed; inspect each file with `openssl x509 -in <file> -noout -text`: {}\", e.getMessage(), e.getCause());\n    throw e;\n}","preventionTips":["Validate every CA file with `openssl x509 -in ca.pem -noout` before deploying.","Ensure each file contains at least one `-----BEGIN CERTIFICATE-----` block.","Do not point certificate_authorities at CSRs, CRLs, or directories."],"tags":["ssl","pem","truststore","elasticsearch","crypto","config"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}