{"record":{"id":"b9daf8a9961d61d0","repo":"elastic/elasticsearch","slug":"trust-store-does-not-contain-any-trusted-certifica","errorCode":null,"errorMessage":"Trust-store does not contain any trusted certificate entries","messagePattern":"Trust-store does not contain any trusted certificate entries","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"build-tools/src/main/java/org/elasticsearch/gradle/testclusters/SslTrustResolver.java","lineNumber":138,"sourceCode":"        return sslContext;\n    }\n\n    private TrustManager[] getTrustManagers(KeyStore trustStore) throws GeneralSecurityException {\n        checkForTrustEntry(trustStore);\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n        tmf.init(trustStore);\n        return tmf.getTrustManagers();\n    }\n\n    private void checkForTrustEntry(KeyStore trustStore) throws KeyStoreException {\n        Enumeration<String> enumeration = trustStore.aliases();\n        while (enumeration.hasMoreElements()) {\n            if (trustStore.isCertificateEntry(enumeration.nextElement())) {\n                // found trusted cert entry\n                return;\n            }\n        }\n        throw new IllegalStateException(\"Trust-store does not contain any trusted certificate entries\");\n    }\n\n    private static KeyStore buildTrustStoreFromCA(Set<File> files) throws GeneralSecurityException, IOException {\n        final KeyStore store = KeyStore.getInstance(KeyStore.getDefaultType());\n        store.load(null, null);\n        int counter = 0;\n        for (File ca : files) {\n            for (Certificate certificate : readCertificates(ca)) {\n                store.setCertificateEntry(\"cert-\" + counter, certificate);\n                counter++;\n            }\n        }\n        return store;\n    }\n\n    private static TrustManager[] buildTrustManagerFromLeafCertificates(Collection<? extends Certificate> certificates) {\n        final Set<X509Certificate> trusted = certificates.stream()\n            .filter(X509Certificate.class::isInstance)","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/SslTrustResolver.java#L120-L156","documentation":"SslTrustResolver.checkForTrustEntry() iterates all aliases in the configured trustStore and throws if NONE of them is a certificate entry (`isCertificateEntry`). A trustStore with only key entries or empty aliases cannot establish any trust anchor, so TLS handshake would fail unconditionally — the resolver fails fast with a descriptive message instead.","triggerScenarios":"Pointing `.trustStoreFile(...)` at a JKS/PKCS12 file that contains only private key entries (i.e. it's actually a keystore, not a truststore), or an empty/corrupt keystore file, or one whose cert entries were deleted.","commonSituations":"A developer mistakenly passes a node's keystore (containing the private key + its cert chain as key entries) as the client's trustStore; a generated test keystore where `keytool -genkey` was used instead of `-importcert`; a trustStore regenerated by tooling that strips entries; password mismatch causing aliases to enumerate as empty.","solutions":["Verify the file is a trustStore: `keytool -list -v -keystore <file>` and confirm at least one entry shows `Entry type: trustedCertEntry`.","If it's actually a keystore, re-export the public cert and import it into a fresh trustStore with `keytool -importcert -alias <a> -file <cert.pem> -keystore trust.jks`.","Check the trustStore password matches what the resolver uses (a wrong password can yield zero readable entries).","If you intended to trust a CA, switch to `.certificateAuthorities(...)` instead of a trustStore file."],"exampleFix":"# before: passed a keystore as truststore\ntrustStoreFile = file('node-keystore.p12')\n# after: import the cert into a real truststore\nkeytool -importcert -alias node -file node-cert.pem -keystore trust.jks -noprompt\n# then\ntrustStoreFile = file('trust.jks')","handlingStrategy":"validation","validationCode":"// Validate the trustStore has a cert entry before wiring it\nKeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());\ntry (InputStream in = Files.newInputStream(trustStore.toPath())) {\n  ks.load(in, password.toCharArray());\n}\nboolean hasCert = Collections.list(ks.aliases()).stream().anyMatch(ks::isCertificateEntry);\nif (!hasCert) throw new IllegalStateException(\"trustStore has no trustedCertEntry\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate trustStores with `keytool -importcert` (not `-genkey`) so entries are trustedCertEntry.","Always `keytool -list -v` a trustStore before pointing testclusters at it.","Keep keystore and trustStore files in separate, clearly-named paths to avoid mix-ups."],"tags":["gradle","testclusters","ssl","tls","keystore","build-tools"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}