{"record":{"id":"8deac7922cfedb08","repo":"elastic/elasticsearch","slug":"cannot-create-ssl-context","errorCode":null,"errorMessage":"cannot create ssl context","messagePattern":"cannot create ssl context","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"critical","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java","lineNumber":139,"sourceCode":"        certificates.addAll(trustConfig.getConfiguredCertificates());\n        return certificates;\n    }\n\n    /**\n     * Dynamically create a new SSL context based on the current state of the configuration.\n     * Because the {@link #keyConfig() key config} and {@link #trustConfig() trust config} may change based on the\n     * contents of their referenced files (see {@link #getDependentFiles()}, consecutive calls to this method may\n     * return ssl-contexts with different configurations.\n     */\n    public SSLContext createSslContext() {\n        final X509ExtendedKeyManager keyManager = keyConfig.createKeyManager();\n        final X509ExtendedTrustManager trustManager = trustConfig.createTrustManager();\n        try {\n            SSLContext sslContext = SSLContext.getInstance(contextProtocol());\n            sslContext.init(new X509ExtendedKeyManager[] { keyManager }, new X509ExtendedTrustManager[] { trustManager }, null);\n            return sslContext;\n        } catch (GeneralSecurityException e) {\n            throw new SslConfigException(\"cannot create ssl context\", e);\n        }\n    }\n\n    /**\n     * Picks the best (highest security / most recent standard) SSL/TLS protocol (/version) that is supported by the\n     * {@link #supportedProtocols() configured protocols}.\n     */\n    private String contextProtocol() {\n        if (supportedProtocols.isEmpty()) {\n            throw new SslConfigException(\"no SSL/TLS protocols have been configured\");\n        }\n        for (Entry<String, String> entry : ORDERED_PROTOCOL_ALGORITHM_MAP.entrySet()) {\n            if (supportedProtocols.contains(entry.getKey())) {\n                return entry.getValue();\n            }\n        }\n        throw new SslConfigException(\n            \"no supported SSL/TLS protocol was found in the configured supported protocols: \" + supportedProtocols","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java#L121-L157","documentation":"createSslContext wraps any GeneralSecurityException thrown while obtaining the SSLContext instance or calling SSLContext.init. The underlying cause is attached — typically a bad key, bad trust material, or unsupported protocol/algorithm combination. This is the umbrella exception for keystore/truststore/PEM problems at context-build time.","triggerScenarios":"keyConfig.createKeyManager() or trustConfig.createTrustManager() returned a manager that SSLContext.init rejects; the requested contextProtocol() algorithm is not provided by any Provider; key and trust certs chain mismatch; private key does not match the certificate.","commonSituations":"Wrong keystore password; PEM key/cert mismatch; certificate signed with a key the JCE cannot handle; FIPS-mode JVM missing a provider; expired or not-yet-valid cert at init time.","solutions":["Inspect the attached cause — it names the real failure (UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException, etc.).","Verify the key password: keytool -list -v -keystore node.p12; for PEM, openssl pkey -in node.key -check -noout.","Confirm key/cert match: compare the modulus of the private key and certificate (openssl rsa/x509 -noout -modulus).","Ensure the JVM supports the chosen protocol/algorithm — list providers with -XshowSettings:security or Security.getProviders()."],"exampleFix":"// before: key and certificate do not pair\n// ssl.certificate: node.crt   ssl.key: wrong.key\n// after: regenerate so key matches cert\n//   openssl req -x509 -newkey rsa:2048 -nodes \\\n//     -keyout node.key -out node.crt -days 730","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    SSLContext ctx = sslConfig.createSslContext();\n} catch (SslConfigException e) {\n    Throwable cause = e.getCause(); // the GeneralSecurityException\n    log.error(\"SSLContext init failed: {}\", cause.toString());\n    // branch on cause type: UnrecoverableKeyException -> password,\n    // NoSuchAlgorithmException -> provider/protocol, etc.\n    throw e;\n}","preventionTips":["Validate key/trust files before boot using openssl and keytool in a preflight script.","Keep key and cert paired — generate them together and never edit one independently.","Pin the security provider list and test on the same JVM vendor used in production."],"tags":["ssl","keystore","truststore","pem","cryptography"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}