{"record":{"id":"abb77359ea47a973","repo":"pentaho/pentaho-kettle","slug":"kettletrustmanager-exception-couldnotcreatecertstore","errorCode":"KettleTrustManager.Exception.CouldNotCreateCertStore","errorMessage":"KettleTrustManager.Exception.CouldNotCreateCertStore","messagePattern":"KettleTrustManager\\.Exception\\.CouldNotCreateCertStore","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/CustomSocketFactory.java","lineNumber":95,"sourceCode":"  }\n\n  /**\n   * Configures this SSLSocketFactory so that it uses the given keystore as its truststore.\n   */\n  public static synchronized void configure( Bowl bowl, String path, String password ) throws KettleException {\n\n    // Get the appropriate key-store based on the file path...\n    //\n    KeyStore keyStore;\n\n    try {\n      if ( !Utils.isEmpty( path ) && path.endsWith( \".p12\" ) ) {\n        keyStore = KeyStore.getInstance( \"PKCS12\" );\n      } else {\n        keyStore = KeyStore.getInstance( \"JKS\" );\n      }\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString(\n        PKG, \"KettleTrustManager.Exception.CouldNotCreateCertStore\" ), e );\n    }\n\n    trustManagers = new KettleTrustManager[] { new KettleTrustManager( bowl, keyStore, path, password ) };\n    configured.set( true );\n  }\n\n  /**\n   * Configures this SSLSocketFactory so that it trusts any signer.\n   */\n  public static synchronized void configure() {\n    trustManagers = ALWAYS_TRUST_MANAGER;\n    configured.set( true );\n  }\n\n  @Override\n  public Socket createSocket( String host, int port ) throws IOException, UnknownHostException {\n    return factory.createSocket( host, port );","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/CustomSocketFactory.java#L77-L113","documentation":"Thrown by CustomSocketFactory.configure() when instantiating the KeyStore for the client certificate fails (KeyStore.getInstance or related setup throws). This happens while setting up the SSL socket factory for secure LDAP (LDAPS). Without a valid keystore object the TLS trust manager cannot be built, so the secure connection setup aborts.","triggerScenarios":"configure() is called with a certificate path set, and KeyStore.getInstance(\"PKCS12\") or KeyStore.getInstance(\"JKS\") (or keystore initialization) throws because the keystore type/provider is unavailable or the keystore setup is invalid.","commonSituations":"Certificate file is not actually PKCS12 or JKS format; JVM lacks the PKCS12 provider; the path points to a corrupt or zero-byte file; wrong file extension forces the wrong keystore type (only .p12 is detected as PKCS12, .pfx is not).","solutions":["Verify the certificate file is a valid keystore: keytool -list -keystore cert.p12","Ensure a .p12/.pfx file is named with the .p12 extension (or convert it), since only that suffix selects PKCS12","Regenerate/convert the certificate: keytool -importkeystore to produce a fresh JKS","Check the JVM provider configuration (java.security) if PKCS12 support is missing"],"exampleFix":"// before\nmy-cert.pfx  (renamed to my-cert.jks in the dialog)\n// after\nkeytool -importkeystore -srckeystore my-cert.pfx -srcstoretype pkcs12 -destkeystore my-cert.jks -deststoretype jks\n// then configure the step with my-cert.jks","handlingStrategy":"validation","validationCode":"// Validate certificate file before configuring LDAPS\nFile f = new File(certPath);\nif (!f.isFile() || f.length() == 0) throw new IllegalStateException(\"Bad cert path: \" + certPath);\n// verify format\ntry (FileInputStream in = new FileInputStream(f)) {\n  KeyStore ks = KeyStore.getInstance(certPath.endsWith(\".p12\") ? \"PKCS12\" : \"JKS\");\n  ks.load(in, password.toCharArray());\n}","typeGuard":null,"tryCatchPattern":"try {\n  configureLdapStep(certPath, password);\n} catch (KettleException e) {\n  throw new IllegalStateException(\"Cert store creation failed: \" + e.getCause(), e.getCause());\n}","preventionTips":["Name PKCS12 files with the .p12 extension (only that suffix triggers PKCS12 handling)","Validate keystore with keytool -list before use","Avoid corrupt/zero-byte certificate files"],"tags":["ldap","ssl","keystore"],"backgroundTag":"file-read-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}