{"record":{"id":"958c4c5274e9821a","repo":"apache/seatunnel","slug":"amazondocumentdb-tls-ca-bundle-contains-no-certifi","errorCode":null,"errorMessage":"AmazonDocumentDB TLS CA bundle contains no certificates: ","messagePattern":"AmazonDocumentDB TLS CA bundle contains no certificates: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java","lineNumber":215,"sourceCode":"        try {\n            BsonDocument.parse(value);\n        } catch (RuntimeException e) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB option '\"\n                            + optionName\n                            + \"' must be a valid BSON/JSON document\",\n                    e);\n        }\n    }\n\n    /** Builds an isolated trust context from every X.509 certificate in the supplied CA bundle. */\n    private static SSLContext createSslContext(Path caBundlePath) {\n        try (InputStream inputStream = Files.newInputStream(caBundlePath)) {\n            CertificateFactory certificateFactory = CertificateFactory.getInstance(\"X.509\");\n            Collection<? extends Certificate> certificates =\n                    certificateFactory.generateCertificates(inputStream);\n            if (certificates.isEmpty()) {\n                throw new IllegalArgumentException(\n                        \"AmazonDocumentDB TLS CA bundle contains no certificates: \" + caBundlePath);\n            }\n\n            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n            trustStore.load(null, null);\n            int certificateIndex = 0;\n            for (Certificate certificate : certificates) {\n                trustStore.setCertificateEntry(\n                        \"amazondocumentdb-ca-\" + certificateIndex, certificate);\n                certificateIndex++;\n            }\n\n            TrustManagerFactory trustManagerFactory =\n                    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            trustManagerFactory.init(trustStore);\n            SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n            sslContext.init(null, trustManagerFactory.getTrustManagers(), null);\n            return sslContext;","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java#L197-L233","documentation":"createSslContext loads the TLS CA bundle with CertificateFactory.generateCertificates and throws IllegalArgumentException if the parsed collection is empty. It means the file exists and is readable but contains no X.509 certificates. The trust store would otherwise be empty, causing silent TLS handshake failures later.","triggerScenarios":"tls_ca_file points to a file with no PEM/DER certificates: an empty file, an HTML error page saved as .pem, a truncated download, or a text file containing only the bundle URL.","commonSituations":"curl followed a redirect and saved HTML; download interrupted leaving a 0-byte file; user saved the AWS docs page instead of global-bundle.pem.","solutions":["Re-download the official bundle: `wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`.","Check the file begins with `-----BEGIN CERTIFICATE-----` and has nonzero size (`grep -c BEGIN CERTIFICATE file`).","If a URL was configured, note tls_ca_file needs a local path, not an http:// URL."],"exampleFix":"// before\ntls_ca_file = \"/opt/certs/bundle.pem\"  // 0-byte truncated download\n// after\ntls_ca_file = \"/opt/certs/global-bundle.pem\"  // verified: 40+ CERTIFICATE blocks","handlingStrategy":"validation","validationCode":"Path p = Paths.get(caBundle);\nbyte[] bytes = Files.readAllBytes(p);\nif (bytes.length == 0 || new String(bytes, StandardCharsets.ISO_8859_1).indexOf(\"BEGIN CERTIFICATE\") < 0) {\n    throw new IllegalArgumentException(\"CA bundle contains no certificates: \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["After downloading, verify `grep -c 'BEGIN CERTIFICATE' bundle.pem` is > 0.","Check file size matches expectations (global-bundle.pem is hundreds of KB).","Never save HTML pages as .pem; follow AWS docs URL exactly."],"tags":["tls","certificates","file-content"],"backgroundTag":"invalid-certificate-bundle","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}