{"record":{"id":"a4ea74cd4877ea7f","repo":"gradle/gradle","slug":"trust-store-file-does-not-exist-or-is-not-reada","errorCode":null,"errorMessage":"Trust store file {} does not exist or is not readable. This may lead to SSL connection failures.","messagePattern":"Trust store file (.+?) does not exist or is not readable\\. This may lead to SSL connection failures\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"platforms/software/resources-http/src/main/java/org/gradle/internal/resource/transport/http/SystemDefaultSSLContextFactory.java","lineNumber":147,"sourceCode":"        return getDefaultSecurityPath() + File.separator + \"jssecacerts\";\n    }\n\n    private static TrustManager[] getTrustManagers() throws Exception {\n        String storePath = System.getProperty(\"javax.net.ssl.trustStore\", getDefaultJsseTrustStore());\n        String storeType = System.getProperty(\"javax.net.ssl.trustStoreType\", KeyStore.getDefaultType());\n        String storeProvider = System.getProperty(\"javax.net.ssl.trustStoreProvider\", \"\");\n        String storePasswordString = System.getProperty(\"javax.net.ssl.trustStorePassword\", \"\");\n\n        KeyStore keyStore = null;\n        if (!NONE.equals(storePath)) {\n            String[] fileNames = new String[]{storePath, getDefaultTrustStore()};\n            for (String fileName : fileNames) {\n                File candidate = new File(fileName);\n                if (candidate.isFile() && candidate.canRead()) {\n                    storePath = fileName;\n                    break;\n                } else if (!fileName.equals(getDefaultJsseTrustStore())) {\n                    LOGGER.warn(\"Trust store file {} does not exist or is not readable. This may lead to SSL connection failures.\", fileName);\n                }\n            }\n\n            char[] storePassword = null;\n            if (!storePasswordString.isEmpty()) {\n                storePassword = storePasswordString.toCharArray();\n            }\n\n            keyStore = loadKeyStore(\n                storePath,\n                storeType,\n                storeProvider,\n                storePassword,\n                false\n            );\n        }\n\n        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/gradle/gradle/blob/534f27719b66953f95cc907aae7f2c1b12f5482d/platforms/software/resources-http/src/main/java/org/gradle/internal/resource/transport/http/SystemDefaultSSLContextFactory.java#L129-L165","documentation":"SystemDefaultSSLContextFactory builds the SSLContext used for HTTPS downloads. When javax.net.ssl.trustStore points at a path that is not an existing readable file (and is not the JSSE default location), the candidate is skipped with this warning and the factory falls back to the next candidate; if no trust store loads, HTTPS downloads fail with SSL handshake errors (e.g. PKIX path building failed).","triggerScenarios":"Setting systemProp.javax.net.ssl.trustStore (or -Djavax.net.ssl.trustStore) to a typo'd path, a relative path resolved against a different working directory, a file on an unmounted share, or a file without read permission for the daemon user.","commonSituations":"Corporate PKI truststores provisioned per machine and missing on CI agents; relative paths that work locally but not from the daemon; permission tightening after security hardening; container images that forgot to copy the truststore.","solutions":["Point javax.net.ssl.trustStore at an existing, readable absolute path (plus trustStoreType / trustStorePassword as needed)","Verify from the same user the daemon runs as: ls -l <path> and test -r <path>","Remove the property to use the default JSSE truststore ($JAVA_HOME/lib/security/cacerts)","Alternatively import corporate CAs into cacerts with keytool -importcert instead of shipping a custom store"],"exampleFix":"# before\nsystemProp.javax.net.ssl.trustStore=certs/corp-truststore.jks\n\n# after\nsystemProp.javax.net.ssl.trustStore=/etc/gradle/ssl/corp-truststore.jks\nsystemProp.javax.net.ssl.trustStoreType=JKS","handlingStrategy":"validation","validationCode":"# before the build, run as the same user as the Gradle daemon\nTS=$(grep -oP '^systemProp\\.javax\\.net\\.ssl\\.trustStore=\\K.*' gradle.properties || true)\n[ -z \"$TS\" ] || { [ -f \"$TS\" ] && [ -r \"$TS\" ]; } \\\n  || { echo \"trust store missing or unreadable: $TS\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for truststore configuration","Provision truststores via configuration management so CI and dev machines match","Prefer importing corporate CAs into the JVM cacerts when feasible"],"tags":["gradle","ssl","tls","truststore","https","configuration"],"backgroundTag":"missing-trust-store","analyzedSha":"534f27719b66953f95cc907aae7f2c1b12f5482d","analyzedAt":"2026-08-22T08:09:12.375Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}