{"record":{"id":"a61688700121f02f","repo":"pentaho/pentaho-kettle","slug":"rest-error-certificateexception","errorCode":"Rest.Error.CertificateException","errorMessage":"Rest.Error.CertificateException","messagePattern":"Rest\\.Error\\.CertificateException","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java","lineNumber":369,"sourceCode":"        }\n      }\n      // SSL TRUST STORE CONFIGURATION\n      setSSLConfiguration( data );\n    }\n  }\n\n  protected void setSSLConfiguration( RestData data ) throws KettleException {\n    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {\n      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),\n        trustStoreIn,\n        data.trustStorePassword );\n\n    } catch ( NoSuchAlgorithmException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.NoSuchAlgorithm\" ), e );\n    } catch ( KeyStoreException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyStoreException\" ), e );\n    } catch ( CertificateException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.CertificateException\" ), e );\n    } catch ( FileNotFoundException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.FileNotFound\", data.trustStoreFile ), e );\n    } catch ( IOException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.IOException\" ), e );\n    } catch ( KeyManagementException | UnrecoverableKeyException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyManagementException\" ), e );\n    }\n  }\n\n  /**\n   * Get an InputStream for the file with the given name.\n   * If the file name is empty or null, returns null.\n   *\n   * @param fileName the file name to get InputStream from\n   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null\n   * @throws KettleException if any error occurs while getting the InputStream\n   */\n  protected InputStream getInputStream( String fileName ) throws KettleException {","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java#L351-L387","documentation":"setSSLConfiguration wraps java.security.cert.CertificateException from HttpClientManager.getSslContext in a KettleException with Rest.Error.CertificateException. The trust store's certificates could not be parsed/loaded — the file contains malformed or unreadable certificate data.","triggerScenarios":"Trust store contains a corrupted or non-DER/PEM certificate entry; the file is a raw certificate rather than a keystore; certificate entries damaged during transfer (e.g. FTP ASCII mode, copy-paste).","commonSituations":"Exported certificate pasted into a text editor altering line endings; a PEM chain saved with a .jks extension and passed as a trust store; partially downloaded trust store file.","solutions":["Verify the trust store with keytool -list; recreate it if entries are corrupt","Import the certificate cleanly: keytool -importcert -alias server -file server.crt -keystore truststore.p12 -storetype PKCS12","Transfer the file in binary mode / re-download it if it was corrupted in transit","Confirm the file is a real keystore, not a bare PEM certificate","Check the cause chain for which certificate entry failed to parse"],"exampleFix":"// before\n# using a PEM file directly as trust store\nTrustStore File: server.crt\n// after\nkeytool -importcert -alias server -file server.crt -keystore truststore.p12 -storetype PKCS12 -storepass changeit\nTrustStore File: truststore.p12","handlingStrategy":"validation","validationCode":"// confirm the trust store's certificates parse before the step loads them\njava.security.KeyStore ks = java.security.KeyStore.getInstance( \"PKCS12\" );\ntry ( var in = new java.io.FileInputStream( trustStoreFile ) ) {\n  ks.load( in, password );\n  if ( ks.size() == 0 ) {\n    throw new IllegalStateException( \"Trust store contains no certificates\" );\n  }\n} // CertificateException here means corrupt/malformed entries","typeGuard":null,"tryCatchPattern":"try {\n  step.setConfig( meta, data, row );\n} catch ( KettleException e ) {\n  if ( e.getMessage().contains( \"CertificateException\" ) ) {\n    log.error( \"Trust store has malformed certificates — re-import the server cert\", e );\n  }\n}","preventionTips":["Import certificates only with keytool -importcert; never hand-edit store files","Transfer trust stores in binary mode to avoid corruption","Verify with keytool -list that each alias parses cleanly","Ensure the file is a real keystore, not a PEM certificate chain saved with a keystore extension"],"tags":["ssl","certificate","java"],"backgroundTag":"ssl-configuration-error","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}