{"record":{"id":"a00b7f1f697cc153","repo":"apache/seatunnel","slug":"tls-certificate-verification-disabled-not-recomm","errorCode":null,"errorMessage":"TLS certificate verification disabled - not recommended for production","messagePattern":"TLS certificate verification disabled - not recommended for production","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java","lineNumber":105,"sourceCode":"                Optional<String> truststorePassword =\n                        config.getOptional(ElasticsearchBaseOptions.TLS_TRUST_STORE_PASSWORD);\n\n                Optional<SSLContext> sslContext =\n                        SSLUtils.buildSSLContext(\n                                keystorePath, keystorePassword, truststorePath, truststorePassword);\n\n                if (sslContext.isPresent()) {\n                    httpClientBuilder.setSSLContext(sslContext.get());\n                    log.debug(\"Custom SSL context configured with keystore/truststore\");\n                } else {\n                    log.debug(\"No custom SSL context configured, using default\");\n                }\n            } else {\n                // Trust all certificates (not recommended for production)\n                SSLContext sslContext =\n                        SSLContexts.custom().loadTrustMaterial(new TrustAllStrategy()).build();\n                httpClientBuilder.setSSLContext(sslContext);\n                log.warn(\"TLS certificate verification disabled - not recommended for production\");\n            }\n\n            if (!tlsVerifyHostnames) {\n                httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);\n                log.warn(\"TLS hostname verification disabled - not recommended for production\");\n            }\n\n            log.debug(\n                    \"TLS configuration completed - certificate verification: {}, hostname verification: {}\",\n                    tlsVerifyCertificate,\n                    tlsVerifyHostnames);\n        } catch (Exception e) {\n            throw new RuntimeException(\"Failed to configure TLS settings\", e);\n        }\n    }\n}\n","sourceCodeStart":87,"sourceCodeEnd":122,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java#L87-L122","documentation":"AbstractAuthenticationProvider.configureTLS builds an SSLContext with TrustAllStrategy when tls_verify_certificate=false, disabling all certificate verification. This warn is logged to flag the insecure configuration; it is not an exception.","triggerScenarios":"Configuring an Elasticsearch connection with https and setting tls_verify_certificate to false (explicitly or via defaults), then calling configure.","commonSituations":"Self-signed certificates in dev/test clusters; users disabling verification to bypass PKIX path building failures in production by mistake.","solutions":["Set tls_verify_certificate=true and install the proper CA cert into the truststore","Import the cluster's self-signed certificate into a custom truststore referenced by config","Only keep verification disabled in isolated dev/test environments"],"exampleFix":"// before\nurl = \"https://es:9200\"\ntls_verify_certificate = false\n// after\nurl = \"https://es:9200\"\ntls_verify_certificate = true\nkeystore-path = \"/path/to/truststore.jks\"\nkeystore-password = \"***\"","handlingStrategy":"validation","validationCode":"// fail fast in production if TLS verification is off\nif (\"production\".equals(env) && !config.tlsVerifyCertificate) {\n    throw new IllegalStateException(\"tls_verify_certificate must be true in production\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never disable tls_verify_certificate outside dev/test","Install proper CA/truststore instead of TrustAllStrategy","Audit configs for security-disabled flags before deploy"],"tags":["tls","security","ssl"],"backgroundTag":"tls-verification-disabled","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}