{"record":{"id":"98883db334ffd6b4","repo":"grpc/grpc-java","slug":"failed-to-find-x509extendedtrustmanager-with-defau","errorCode":null,"errorMessage":"Failed to find X509ExtendedTrustManager with default TrustManager algorithm ","messagePattern":"Failed to find X509ExtendedTrustManager with default TrustManager algorithm ","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java","lineNumber":146,"sourceCode":"  }\n\n  private static X509ExtendedTrustManager createDelegateTrustManager(KeyStore keyStore)\n      throws CertificateException, KeyStoreException, NoSuchAlgorithmException {\n    TrustManagerFactory tmf = TrustManagerFactory.getInstance(\n        TrustManagerFactory.getDefaultAlgorithm());\n    tmf.init(keyStore);\n    X509ExtendedTrustManager delegateManager = null;\n    TrustManager[] tms = tmf.getTrustManagers();\n    // Iterate over the returned trust managers, looking for an instance of X509TrustManager.\n    // If found, use that as the delegate trust manager.\n    for (TrustManager tm : tms) {\n      if (tm instanceof X509ExtendedTrustManager) {\n        delegateManager = (X509ExtendedTrustManager) tm;\n        break;\n      }\n    }\n    if (delegateManager == null) {\n      throw new CertificateException(\n          \"Failed to find X509ExtendedTrustManager with default TrustManager algorithm \"\n              + TrustManagerFactory.getDefaultAlgorithm());\n    }\n    return delegateManager;\n  }\n\n  private void checkTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine,\n      Socket socket, boolean checkingServer) throws CertificateException {\n    if (chain == null || chain.length == 0) {\n      throw new IllegalArgumentException(\n          \"Want certificate verification but got null or empty certificates\");\n    }\n    if (sslEngine == null && socket == null) {\n      throw new CertificateException(NOT_ENOUGH_INFO_MESSAGE);\n    }\n    if (this.verification != Verification.INSECURELY_SKIP_ALL_VERIFICATION) {\n      X509ExtendedTrustManager currentDelegateManager = this.delegateManager;\n      if (currentDelegateManager == null) {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java#L128-L164","documentation":"When the trust manager is configured to use system default trust certificates, it iterates the default TrustManagerFactory's managers looking for an X509ExtendedTrustManager. If none of the returned managers is an X509ExtendedTrustManager instance, it throws this CertificateException because hostname/peer verification depends on the extended interface. This indicates the JVM's default TrustManager algorithm produced only basic X509TrustManagers.","triggerScenarios":"Calling useSystemDefaultTrustCerts() or updateTrustCredentials(systemDefault) when TrustManagerFactory.getDefaultAlgorithm() (typically 'PKIX') returns managers that do not include an X509ExtendedTrustManager.","commonSituations":"Custom security providers (java.security security.provider overrides) that supply non-extended trust managers; exotic or embedded JVMs with a reduced JSSE; a Security property override of ssl.TrustManagerFactory.algorithm pointing to a non-JSSE provider; classloader/pro shading issues where X509ExtendedTrustManager resolution fails.","solutions":["Inspect java.security's ssl.TrustManagerFactory.algorithm and security.provider list; restore the default JSSE provider (SunJSSE) so PKIX yields X509ExtendedTrustManager.","Run on a standard JVM (JDK 7+ SunJSSE always returns X509ExtendedTrustManager) instead of a stripped/embedded JRE.","Avoid useSystemDefaultTrustCerts; call updateTrustCredentials(CertificateType.FILE_PATH, ...) with an explicit CA bundle and skip delegate creation from the default factory.","Verify no library on the classpath replaces the default TrustManagerFactory via Security.setProperty before this call."],"exampleFix":"// before\ntrustManager.useSystemDefaultTrustCerts();\n\n// after\ntrustManager.updateTrustCredentials(\n    CertificateType.FILE_PATH,\n    \"/etc/ssl/certs/ca-certificates.crt\",\n    /*certChainCheckingIntervalMs*/ 60000);","handlingStrategy":"validation","validationCode":"TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init((KeyStore) null);\nboolean hasExtended = false;\nfor (TrustManager tm : tmf.getTrustManagers()) {\n  if (tm instanceof X509ExtendedTrustManager) { hasExtended = true; break; }\n}\nif (!hasExtended) {\n  throw new IllegalStateException(\"Default algorithm yields no X509ExtendedTrustManager; configure CA file instead\");\n}","typeGuard":"static boolean isExtended(TrustManager tm) {\n  return tm instanceof X509ExtendedTrustManager;\n}","tryCatchPattern":"try {\n  trustManager.useSystemDefaultTrustCerts();\n} catch (CertificateException e) {\n  if (e.getMessage().startsWith(\"Failed to find X509ExtendedTrustManager\")) {\n    trustManager.updateTrustCredentials(CertificateType.FILE_PATH, caBundlePath, 60000);\n  } else {\n    throw e;\n  }\n}","preventionTips":["Verify the JVM's security providers and ssl.TrustManagerFactory.algorithm are defaults before using system trust certs.","Prefer explicit updateTrustCredentials(CertificateType.FILE_PATH, ...) for deterministic behavior across environments.","Run on a standard JDK (SunJSSE) rather than stripped/embedded runtimes.","Check for libraries calling Security.setProperty that could replace the default trust manager algorithm."],"tags":["tls","certificate","trust-manager","jvm"],"backgroundTag":"resource-not-found","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}