{"record":{"id":"97e44ca351dba390","repo":"elastic/elasticsearch","slug":"65-97e44c","errorCode":"65","errorMessage":"{}","messagePattern":"\\{\\}","errorType":"exception","errorClass":"UserException","httpStatus":null,"severity":"error","filePath":"distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/ChangeKeyStorePasswordCommand.java","lineNumber":37,"sourceCode":"import org.elasticsearch.env.Environment;\n\n/**\n * A sub-command for the keystore cli which changes the password.\n */\nclass ChangeKeyStorePasswordCommand extends BaseKeyStoreCommand {\n\n    ChangeKeyStorePasswordCommand() {\n        super(\"Changes the password of a keystore\", true);\n    }\n\n    @Override\n    protected void executeCommand(Terminal terminal, OptionSet options, Environment env) throws Exception {\n        try (SecureString newPassword = readPassword(terminal, true)) {\n            final KeyStoreWrapper keyStore = getKeyStore();\n            keyStore.save(env.configDir(), newPassword.getChars());\n            terminal.println(\"Elasticsearch keystore password changed successfully.\");\n        } catch (SecurityException e) {\n            throw new UserException(ExitCodes.DATA_ERROR, e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":41,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/ChangeKeyStorePasswordCommand.java#L19-L41","documentation":"Generic `{}` UserException (DATA_ERROR 65) from ChangeKeyStorePasswordCommand. It catches `SecurityException` thrown while reading the new password pair or while calling `keyStore.save(configDir, newPassword)`. The re-encrypted keystore save can fail with SecurityException if the in-memory keystore state is inconsistent (it was decrypted earlier in BaseKeyStoreCommand), or if the underlying JCE keystore operation rejects the password.","triggerScenarios":"Running `change-password` on a keystore whose decryption already failed (so the wrapper SecurityException from BaseKeyStoreCommand propagates a second one); passwords entered at the two prompts that do not match in a way the reader flags; JVM crypto provider issues during re-encryption.","commonSituations":"Mismatched new-password confirmation; attempting change-password after the keystore password was already forgotten (so the initial decrypt failed); restricted JVM environment.","solutions":["Ensure the current keystore password decrypts successfully first (test with `has-password` then any read command).","Re-enter the new password pair carefully, ensuring both prompts match.","On JVM crypto errors, verify the security providers and re-run."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    changePassword();\n} catch (UserException e) {\n    if (e.exitCode == ExitCodes.DATA_ERROR) {\n        // verify current password works first via has-password + a read command\n    }\n}","preventionTips":["Confirm the current password decrypts before running change-password.","Ensure both new-password prompts match exactly.","Back up the keystore before changing the password."],"tags":["elasticsearch","keystore-cli","auth","crypto"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}