{"record":{"id":"bacb0c3d528fb71d","repo":"pentaho/pentaho-kettle","slug":"rest-error-ioexception","errorCode":"Rest.Error.IOException","errorMessage":"Rest.Error.IOException","messagePattern":"Rest\\.Error\\.IOException","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java","lineNumber":373,"sourceCode":"    }\n  }\n\n  protected void setSSLConfiguration( RestData data ) throws KettleException {\n    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {\n      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),\n        trustStoreIn,\n        data.trustStorePassword );\n\n    } catch ( NoSuchAlgorithmException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.NoSuchAlgorithm\" ), e );\n    } catch ( KeyStoreException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyStoreException\" ), e );\n    } catch ( CertificateException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.CertificateException\" ), e );\n    } catch ( FileNotFoundException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.FileNotFound\", data.trustStoreFile ), e );\n    } catch ( IOException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.IOException\" ), e );\n    } catch ( KeyManagementException | UnrecoverableKeyException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyManagementException\" ), e );\n    }\n  }\n\n  /**\n   * Get an InputStream for the file with the given name.\n   * If the file name is empty or null, returns null.\n   *\n   * @param fileName the file name to get InputStream from\n   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null\n   * @throws KettleException if any error occurs while getting the InputStream\n   */\n  protected InputStream getInputStream( String fileName ) throws KettleException {\n    InputStream inputStream = null;\n\n    if ( !StringUtil.isEmpty( fileName ) ) {\n      fileName = fileName.trim();","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java#L355-L391","documentation":"Wraps a java.io.IOException thrown during SSL setup in setSSLConfiguration (called by setConfig) while loading the trust/keystore. The message is the generic localized 'Error'. IOException here usually means the trust store file exists but is corrupt, has the wrong password, or is in an unexpected format.","triggerScenarios":"KeyStore.load(InputStream, password) or the SSLContext/TrustManagerFactory initialization fails with an I/O problem: truncated/corrupt .jks/.p12 file, wrong store password, or file that is a directory/locked.","commonSituations":"Trust store created with a newer Java format than the runtime JCE supports; file corrupted in transfer (FTP ASCII mode); password containing characters mangled by variable substitution; store exported from Windows certmgr in a format Java cannot parse.","solutions":["Validate the trust store with 'keytool -list -v -keystore <file>' using the configured password; re-export the store if keytool fails.","Re-check the trust store password setting in the step — a wrong password typically surfaces as an IOException from KeyStore.load.","Recreate the trust store: keytool -importcert -file ca.crt -keystore truststore.jks.","Confirm the file transferred in binary mode and is not truncated (compare file sizes/checksums)."],"exampleFix":"// before\ncertutil -encode ca.crt ca.pem   # wrong format fed to java keystore\n// after — build a proper JKS trust store\nkeytool -importcert -alias ca -file ca.pem -keystore truststore.jks -storepass changeit -noprompt","handlingStrategy":"validation","validationCode":"// Sanity-check the store before configuring the step\ntry (InputStream in = new FileInputStream(trustStoreFile)) {\n  KeyStore ks = KeyStore.getInstance(\"JKS\");\n  ks.load(in, storePassword.toCharArray()); // throws IOException if corrupt/wrong password\n}","typeGuard":null,"tryCatchPattern":"try { setSSLConfiguration(); } catch (KettleException e) {\n  if (e.getCause() instanceof IOException) { /* validate keystore file + password */ }\n  throw e;\n}","preventionTips":["Run keytool -list against every trust store before deployment.","Transfer key stores in binary mode only.","Keep store passwords free of characters that variable substitution could mangle.","Pin the JCE/JDK version used to create and consume key stores."],"tags":["ssl","keystore","io","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}