{"record":{"id":"8e97063c650565eb","repo":"karatelabs/karate","slug":"could-not-build-the-pooled-client-s-ssl-context","errorCode":null,"errorMessage":"could not build the pooled client's SSL context","messagePattern":"could not build the pooled client's SSL context","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"karate-gatling/src/main/java/io/karatelabs/gatling/PooledHttpClientFactory.java","lineNumber":163,"sourceCode":"    private static TlsSocketStrategy trustAllTlsStrategy() {\n        try {\n            SSLContext context = SSLContextBuilder.create()\n                    .loadTrustMaterial(null, (chain, authType) -> true)\n                    .build();\n            // TlsSocketStrategy rather than the SSLConnectionSocketFactory karate-core still uses:\n            // that one is deprecated in httpclient5 5.6 and this is new code, so it takes the\n            // replacement instead of a @SuppressWarnings.\n            //\n            // The policy has to be CLIENT and cannot be left to default. Since 5.4 the default is\n            // BUILTIN, which asks the JDK to verify the hostname during the handshake — before the\n            // supplied verifier is consulted at all, so a NoopHostnameVerifier is simply never\n            // reached. Measured: against a certificate with no subject alternative names, the\n            // default failed every request with \"No subject alternative names present\" while the\n            // trust-all context was working exactly as intended.\n            return new DefaultClientTlsStrategy(context, HostnameVerificationPolicy.CLIENT,\n                    NoopHostnameVerifier.INSTANCE);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"could not build the pooled client's SSL context\", e);\n        }\n    }\n\n    @Override\n    public HttpClient create() {\n        return new PooledApacheHttpClient();\n    }\n\n    /**\n     * Closes the scenario's wrapper, which returns its connections to the pool rather than\n     * shutting it: {@code ApacheHttpClient} builds with {@code setConnectionManagerShared(true)}\n     * whenever {@code sharedConnectionManager()} is non-null.\n     */\n    @Override\n    public void release(HttpClient client) {\n        try {\n            client.close();\n        } catch (Exception e) {","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-gatling/src/main/java/io/karatelabs/gatling/PooledHttpClientFactory.java#L145-L181","documentation":"PooledHttpClientFactory builds a trust-all TLS strategy for its pooled Apache HTTP client by constructing an SSLContext. If SSL context initialization fails (keystore problems, unavailable TLS algorithm, security provider issues), it wraps the cause in an IllegalStateException with this message.","triggerScenarios":"Creating the pooled client factory on a JVM where the default SSLContext cannot be built — e.g. TLS.getSystemTrustStore misconfigured, a broken javax.net.ssl custom keystore, or a restricted JCE environment lacking required algorithms.","commonSituations":"Custom truststore paths via -Djavax.net.ssl.* pointing at missing/corrupt files; FIPS-enabled JVMs where default algorithms are unavailable; exotic JDKs or old Java versions lacking TLS 1.3; malformed keystore passwords in the environment.","solutions":["Inspect the wrapped cause (e.getCause()) to find the actual SSL failure","Remove or fix custom -Djavax.net.ssl.trustStore/keyStore system properties pointing at missing or corrupt files","Run on a supported JDK with standard TLS providers (check `java -version` and try a recent LTS)","If a custom keystore is intentional, verify its password and format (PKCS12 vs JKS)"],"exampleFix":"// before (startup flags)\njava -Djavax.net.ssl.trustStore=/missing/cacerts -jar sim.jar\n// after\njava -jar sim.jar   # or point trustStore at a valid keystore file","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { return PooledHttpClientFactory.withTrustAllTls(); } catch (IllegalStateException e) { throw new RuntimeException(\"SSL context init failed: \" + e.getCause(), e); }","preventionTips":["Avoid ad-hoc javax.net.ssl.* system properties; test keystore config in a smoke run","Pin a supported JDK/LTS version for perf simulations","Log e.getCause() — the root cause names the exact SSL problem","Verify keystores with keytool before deploying"],"tags":["java","ssl","tls","http-client"],"backgroundTag":"ssl-context-init-failed","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}