{"record":{"id":"8faec40b594511b9","repo":"pentaho/pentaho-kettle","slug":"failed-to-set-ssl-context","errorCode":null,"errorMessage":"Failed to set SSL context: ","messagePattern":"Failed to set SSL context: ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/pentaho/di/core/util/HttpClientManager.java","lineNumber":182,"sourceCode":"        requestConfigBuilder.setProxy( proxy );\n      }\n      httpClientBuilder.setDefaultRequestConfig( requestConfigBuilder.build() );\n\n      if ( provider != null ) {\n        httpClientBuilder.setDefaultCredentialsProvider( provider );\n      }\n      if ( redirectStrategy != null ) {\n        httpClientBuilder.setRedirectStrategy( redirectStrategy );\n      }\n\n      if ( trustStoreStream != null || keyStoreStream != null || ignoreSsl ) {\n        try {\n          SSLContext sslContext =\n            HttpClientManager.getSslContext( ignoreSsl, trustStoreStream, trustStorePassword, keyStoreStream,\n              keyStorePassword, keyPassword );\n          httpClientBuilder.setSSLContext( sslContext );\n        } catch ( Exception e ) {\n          throw new RuntimeException( \"Failed to set SSL context: \" + e.getMessage(), e );\n        }\n      }\n\n      return httpClientBuilder.build();\n    }\n  }\n\n  public static SSLContext getSslContext( boolean ignoreSSLValidation, InputStream trustFileStream,\n                                          String trustStorePassword )\n    throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException, KeyManagementException,\n    UnrecoverableKeyException {\n    return getSslContext( ignoreSSLValidation, trustFileStream, trustStorePassword, null, null, null );\n  }\n\n  /**\n   * @param ignoreSSLValidation if {@code true} will accept all certificates and any supplied trust file will be ignored\n   * @param trustFileStream trust store file\n   * @param trustStorePassword trust store password","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/core/src/main/java/org/pentaho/di/core/util/HttpClientManager.java#L164-L200","documentation":"HttpClientManager wraps any failure while constructing a javax.net.ssl.SSLContext (from the supplied trust store / key store streams) into a RuntimeException with the message \"Failed to set SSL context: \" plus the underlying cause message. It is thrown when getSslContext cannot build a valid SSL context for the HTTP client builder, so no connection is attempted. The original exception is chained as the cause.","triggerScenarios":"Calling HttpClientManager.buildHttpClient / openHttpClient (e.g. via Kettle's HTTP steps or SLF4J/httputil helpers) with ignoreSsl=false and an invalid trustStoreStream/keyStoreStream, a wrong trustStorePassword/keyStorePassword, a corrupted or unsupported keystore format, or an unavailable TLS algorithm.","commonSituations":"Typo in the JVM trust store password; keystore exported in a format the JVM doesn't support (e.g. JKS vs PKCS12 differences across Java versions); self-signed certificate handling configured with a bad keystore file path; running on a JVM missing the requested TLS algorithm (e.g. old algorithm removed in newer JDK).","solutions":["Verify the trust store / key store passwords are correct; a wrong password is the most common cause.","Check that the keystore file exists, is readable and is in a supported format (convert JKS to PKCS12 with keytool if needed).","Look at the chained cause exception (e.getCause()) in your log to identify the exact SSL failure.","If the endpoint uses a self-signed certificate, import it into the trust store with keytool -importcert, or set ignoreSsl=true for testing only.","Confirm the JDK supports the requested TLS protocol/algorithm (check java.version and security properties)."],"exampleFix":"// before\nHttpClientManager.getInstance().createHttpClientBuilder(false, trustStream, \"wrongpass\", null, null, null);\n// after\nHttpClientManager.getInstance().createHttpClientBuilder(false, trustStream, \"changeit\", null, null, null);","handlingStrategy":"try-catch","validationCode":"// before building the client\nif (trustStoreStream == null || trustStorePassword == null) {\n  throw new IllegalArgumentException(\"Trust store stream and password are required\");\n}\n// optionally verify the keystore loads:\nnew java.security.KeyStore().load; // see pattern below\n","typeGuard":null,"tryCatchPattern":"try {\n  HttpClientManager.getInstance().createHttpClientBuilder(...);\n} catch (RuntimeException e) {\n  log.error(\"SSL context setup failed: \" + e.getCause(), e); // inspect the cause\n  throw new KettleException(\"Check keystore paths/passwords\", e);\n}","preventionTips":["Test keystore loading standalone with `keytool -list -keystore file` before wiring it in.","Keep keystore passwords in environment variables, not hardcoded strings that may be edited incorrectly.","Prefer PKCS12 format for cross-JDK-version compatibility."],"tags":["ssl","http-client","keystore","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}