{"record":{"id":"a8e69df8bda79a53","repo":"prestodb/presto","slug":"generic-internal-error-a8e69d","errorCode":"GENERIC_INTERNAL_ERROR","errorMessage":"Failed to initialize SSL context","messagePattern":"Failed to initialize SSL context","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":96,"sourceCode":"     * @return Optional SSLContext, empty if no SSL configuration is provided\n     * @throws PrestoException if SSL context creation fails\n     */\n    public Optional<SSLContext> buildSslContext()\n    {\n        if (!keystorePath.isPresent() && !truststorePath.isPresent()) {\n            log.debug(\"No SSL configuration provided, returning empty SSL context\");\n            return Optional.empty();\n        }\n\n        try {\n            log.debug(\"Creating SSL context with keystore: {}, truststore: {}\",\n                    keystorePath.map(File::getPath).orElse(\"none\"),\n                    truststorePath.map(File::getPath).orElse(\"none\"));\n            return Optional.of(createSSLContext());\n        }\n        catch (GeneralSecurityException | IOException e) {\n            log.error(\"Failed to initialize SSL context\", e);\n            throw new PrestoException(GENERIC_INTERNAL_ERROR, \"Failed to initialize SSL context\", e);\n        }\n    }\n\n    private SSLContext createSSLContext() throws GeneralSecurityException, IOException\n    {\n        // Load KeyStore if configured and get KeyManagers\n        KeyStore keystore = null;\n        KeyManager[] keyManagers = null;\n\n        if (keystorePath.isPresent()) {\n            log.debug(\"Loading keystore from: {}\", keystorePath.get().getPath());\n            keystore = loadKeyStore();\n            keyManagers = createKeyManagers(keystore);\n            log.debug(\"Keystore loaded successfully\");\n        }\n\n        // Load TrustStore if configured, otherwise use KeyStore for backward compatibility\n        // If neither is configured, use system default","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L78-L114","documentation":"SslContextProvider.buildSslContext catches GeneralSecurityException and IOException while assembling the SSLContext (loading keystores, truststores, initializing key/trust managers) and rethrows them as a PrestoException with code GENERIC_INTERNAL_ERROR. The named log line contains the underlying cause.","triggerScenarios":"configureTls/initialize/sslContext call buildSslContext and loading fails: keystore/truststore file missing or unreadable, wrong password, unsupported keystore format, or any KeyStore/TrustManager initialization exception.","commonSituations":"Typo'd keystore path in catalog properties; wrong keystore/truststore password; PEM vs JKS format confusion; file permissions after container image change; JVM missing the crypto provider for the stored key algorithm.","solutions":["Read the log stack trace at 'Failed to initialize SSL context' for the root cause","Verify the keystore/truststore file paths exist and are readable by the Presto process","Confirm passwords match the store; check the format (PEM vs JKS/PKCS12) matches what the provider expects","Regenerate or convert the store (keytool -importkeystore / openssl) if the format or algorithm is unsupported"],"exampleFix":"// before (catalog.properties)\nhttp-server.https.keystore.path=/etc/pki/wrong.jks\n// after\nhttp-server.https.keystore.path=/etc/presto/keystore.jks\nhttp-server.https.keystore.key=correctpassword","handlingStrategy":"validation","validationCode":"# pre-flight checks before starting Presto\nkeytool -list -keystore $KS_PATH -storepass $KS_PASS >/dev/null && \\\nopenssl x509 -in $CERT_PEM -noout >/dev/null && echo SSL-OK","typeGuard":null,"tryCatchPattern":"try {\n    sslContextProvider.sslContext(...);\n} catch (PrestoException e) {\n    if (GENERIC_INTERNAL_ERROR.getCode() == e.getErrorCode()) {\n        log.error(\"SSL init failed; check store paths/passwords\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Verify keystore/truststore paths and passwords with keytool before deployment","Convert PEM/JKS formats explicitly ahead of time","Check file readability as the service user in container entrypoints"],"tags":["presto","ssl","tls","configuration"],"backgroundTag":"ssl-context-init-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}