{"record":{"id":"a7ed820f3d6360cf","repo":"elastic/elasticsearch","slug":"failed-to-find-a-x509extendedkeymanager-in-the-key","errorCode":null,"errorMessage":"failed to find a X509ExtendedKeyManager in the key manager factory for [{}] and keystore [{}]","messagePattern":"failed to find a X509ExtendedKeyManager in the key manager factory for \\[(.+?)\\] and keystore \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java","lineNumber":161,"sourceCode":"        throws GeneralSecurityException, IOException {\n        KeyStore keyStore = buildKeyStore(List.of(certificateChain), privateKey, password);\n        return createKeyManager(keyStore, password, KeyManagerFactory.getDefaultAlgorithm());\n    }\n\n    /**\n     * Creates a {@link X509ExtendedKeyManager} based on the key material in the provided {@link KeyStore}\n     */\n    public static X509ExtendedKeyManager createKeyManager(KeyStore keyStore, char[] password, String algorithm)\n        throws GeneralSecurityException {\n        KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);\n        kmf.init(keyStore, password);\n        KeyManager[] keyManagers = kmf.getKeyManagers();\n        for (KeyManager keyManager : keyManagers) {\n            if (keyManager instanceof X509ExtendedKeyManager x509ExtendedKeyManager) {\n                return x509ExtendedKeyManager;\n            }\n        }\n        throw new SslConfigException(\n            \"failed to find a X509ExtendedKeyManager in the key manager factory for [\" + algorithm + \"] and keystore [\" + keyStore + \"]\"\n        );\n    }\n\n    /**\n     * Creates a {@link X509ExtendedTrustManager} based on the trust material in the provided {@link KeyStore}\n     */\n    public static X509ExtendedTrustManager createTrustManager(@Nullable KeyStore trustStore, String algorithm)\n        throws NoSuchAlgorithmException, KeyStoreException {\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);\n        tmf.init(trustStore);\n        TrustManager[] trustManagers = tmf.getTrustManagers();\n        for (TrustManager trustManager : trustManagers) {\n            if (trustManager instanceof X509ExtendedTrustManager x509ExtendedTrustManager) {\n                return x509ExtendedTrustManager;\n            }\n        }\n        throw new SslConfigException(","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java#L143-L179","documentation":"Thrown by KeyStoreUtil.createKeyManager() when KeyManagerFactory.getKeyManagers() returns an array containing no instance of X509ExtendedKeyManager. The factory initialised successfully but produced only non-X509 managers (or an empty array), so the SSL stack has no usable key manager.","triggerScenarios":"createKeyManager(keyStore, password, algorithm): after kmf.init(...) and iterating keyManagers, no element is an X509ExtendedKeyManager. Common with a non-default algorithm (e.g. PKIX on a provider that returns plain X509KeyManager), an empty or corrupt keystore that causes the factory to return nothing, or a third-party JCE provider.","commonSituations":"Configuring xpack.security.transport.ssl.keystore.algorithm to a non-standard value; using a HSM/PKCS#11 provider whose KeyManagerFactory returns provider-specific types; keystore loaded with the wrong password so no key entries are visible; provider ordering (e.g. BouncyCastle installed as first provider).","solutions":["Use the default algorithm: leave the keystore.algorithm setting unset, or set it to KeyManagerFactory.getDefaultAlgorithm() (typically SunX509).","Verify the keystore opens with the configured password and contains a key entry (`keytool -list -v -keystore ks.p12`).","If using a PKCS#11/HSM provider, consult its docs to ensure it ships an X509ExtendedKeyManager.","Check provider order in `java.security`; move SunJSSE ahead of third-party providers if needed."],"exampleFix":"// before: non-default algorithm produces non-X509 manager\nX509ExtendedKeyManager km = KeyStoreUtil.createKeyManager(ks, pwd, \"PKIX\");\n\n// after: default SunX509 (always returns X509ExtendedKeyManager on stock JVM)\nX509ExtendedKeyManager km = KeyStoreUtil.createKeyManager(\n    ks, pwd, KeyManagerFactory.getDefaultAlgorithm());","handlingStrategy":"validation","validationCode":"// Confirm the algorithm produces X509ExtendedKeyManagers before relying on it.\npublic static boolean algorithmReturnsX509Km(String algorithm, KeyStore ks, char[] pwd) throws Exception {\n    KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);\n    kmf.init(ks, pwd);\n    for (KeyManager km : kmf.getKeyManagers()) {\n        if (km instanceof X509ExtendedKeyManager) return true;\n    }\n    return false;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer the default algorithm (KeyManagerFactory.getDefaultAlgorithm()) unless you have a specific reason.","When using PKCS#11/HSM providers, confirm they ship X509ExtendedKeyManager implementations.","Verify the keystore opens with the configured password and contains a key entry."],"tags":["ssl","keystore","keymanager","jce","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}