{"record":{"id":"8dad6760bd176ef5","repo":"prestodb/presto","slug":"truststore-must-not-be-null-for-tls-connections","errorCode":null,"errorMessage":"Truststore must not be null for TLS connections","messagePattern":"Truststore must not be null for TLS connections","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java","lineNumber":121,"sourceCode":"    {\n        boolean isTlsEnabled = redisConnectorConfig.isTlsEnabled();\n        SSLContext sslContext = null;\n\n        if (isTlsEnabled) {\n            KeyStore trustStore = loadTrustStore();\n            sslContext = createSslContext(trustStore);\n        }\n\n        return buildJedisPool(host, isTlsEnabled, sslContext);\n    }\n\n    /**\n     * Creates SSLContext initialized with the given truststore.\n     */\n    private SSLContext createSslContext(KeyStore trustStore)\n    {\n        if (trustStore == null) {\n            throw new IllegalStateException(\"Truststore must not be null for TLS connections\");\n        }\n\n        try {\n            TrustManagerFactory tmf = TrustManagerFactory.getInstance(getDefaultAlgorithm());\n            tmf.init(trustStore);\n\n            SSLContext sslContext = SSLContext.getInstance(TLS_PROTOCOL);\n            sslContext.init(null, tmf.getTrustManagers(), null);\n\n            return sslContext;\n        }\n        catch (NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) {\n            throw new RuntimeException(\"Failed to initialize SSLContext\", e);\n        }\n    }\n\n    private JedisPoolConfig createJedisPoolConfig()\n    {","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java#L103-L139","documentation":"RedisJedisManager.createSslContext initializes a TrustManagerFactory from a KeyStore to build the TLS SSLContext for TLS Redis connections. If the truststore KeyStore is null it cannot be initialized, so an IllegalStateException is thrown immediately. TLS connections always require a truststore to validate the Redis server certificate.","triggerScenarios":"redis.truststore-path is not configured (null) while redis.tls-enabled=true; the config that loads the truststore returns null before createSslContext is invoked via createJedisPool.","commonSituations":"Enabling TLS on the Redis connector without setting the truststore path property; environment where the config file was not updated after turning on TLS; programmatic connector config missing setTruststorePath.","solutions":["Set redis.truststore-path (redis.truststore-password if needed) to a valid truststore containing the Redis server cert","Disable TLS (redis.tls-enabled=false) if secure connections are not actually required","Verify the connector config is loaded and the path property name is spelled correctly"],"exampleFix":"// before\nredis.tls-enabled=true\n// after\nredis.tls-enabled=true\nredis.truststore-path=/etc/presto/redis/truststore.jks","handlingStrategy":"validation","validationCode":"if (tlsEnabled && (truststorePath == null || truststorePath.isEmpty())) {\n    throw new IllegalArgumentException(\"truststore-path is required when tls-enabled=true\");\n}","typeGuard":null,"tryCatchPattern":"try { createSslContext(trustStore); } catch (IllegalStateException e) { log.error(\"TLS configured without truststore: \" + e.getMessage()); throw e; }","preventionTips":["Always set truststore-path when enabling redis TLS","Fail fast in config validation before pool creation","Document TLS prerequisites in connector deployment notes"],"tags":["redis","tls","ssl","configuration"],"backgroundTag":"missing-truststore","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}