{"record":{"id":"c033d34b5eae7f35","repo":"elastic/elasticsearch","slug":"ssl-trust-has-been-configured-but-is-not-a","errorCode":null,"errorMessage":"SSL trust has been configured, but [{}] is not a 'https' URL","messagePattern":"SSL trust has been configured, but \\[(.+?)\\] is not a 'https' URL","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java","lineNumber":142,"sourceCode":"        } else {\n            throw new IOException(response + \" \" + connection.getResponseMessage());\n        }\n    }\n\n    HttpURLConnection buildConnection(SSLContext ssl) throws IOException {\n        final HttpURLConnection connection = (HttpURLConnection) this.url.openConnection();\n        configureSslContext(connection, ssl);\n        configureBasicAuth(connection);\n        connection.setRequestMethod(\"GET\");\n        return connection;\n    }\n\n    private void configureSslContext(HttpURLConnection connection, SSLContext ssl) {\n        if (ssl != null) {\n            if (connection instanceof HttpsURLConnection) {\n                ((HttpsURLConnection) connection).setSSLSocketFactory(ssl.getSocketFactory());\n            } else {\n                throw new IllegalStateException(\"SSL trust has been configured, but [\" + url + \"] is not a 'https' URL\");\n            }\n        }\n    }\n\n    private void configureBasicAuth(HttpURLConnection connection) {\n        if (username != null) {\n            if (password == null) {\n                throw new IllegalStateException(\"Basic Auth user [\" + username + \"] has been set, but no password has been configured\");\n            }\n            connection.setRequestProperty(\n                \"Authorization\",\n                \"Basic \" + Base64.getEncoder().encodeToString((username + \":\" + password).getBytes(StandardCharsets.UTF_8))\n            );\n        }\n    }\n}\n","sourceCodeStart":124,"sourceCodeEnd":159,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java#L124-L159","documentation":"WaitForHttpResource.configureSslContext() throws when an SSLContext has been configured on the resource but the URL is not an `HttpsURLConnection` (i.e. the URL scheme is `http://`, not `https://`). SSL trust is meaningless over plaintext HTTP, so the build refuses rather than silently sending credentials in the clear or no-op'ing the SSL setup.","triggerScenarios":"Setting `.sslContext(...)` or enabling TLS on a WaitForHttpResource whose `url` field is an `http://...` URL. The resource is used by testclusters to poll node readiness over HTTP.","commonSituations":"Security/TLS enabled on the cluster but the readiness URL constructed with `http://`; copy-pasting a URL template and forgetting to switch the scheme; defaulting the URL to http while conditionally adding SSL config.","solutions":["Change the URL scheme to `https://` so the connection is an `HttpsURLConnection`.","Or, if TLS is genuinely not needed, remove the SSLContext configuration (and disable security on the cluster).","Construct the readiness URL from the cluster's HTTP settings to inherit the correct scheme automatically."],"exampleFix":"// before\nwaitResource.url = 'http://localhost:9200/_cluster/health'\nwaitResource.sslContext = ssl\n// after\nwaitResource.url = 'https://localhost:9200/_cluster/health'\nwaitResource.sslContext = ssl","handlingStrategy":"validation","validationCode":"if (sslContext != null && !\"https\".equalsIgnoreCase(url.getProtocol())) {\n  throw new IllegalStateException(\n    \"SSL configured for non-https URL \" + url + \"; switch to https:// or drop the SSLContext.\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Derive the readiness URL scheme from the cluster's TLS setting rather than hardcoding.","Keep URL and SSL config adjacent in code so they're updated together.","Add a build-time assertion that SSL implies https scheme."],"tags":["gradle","testclusters","ssl","url","configuration","build-tools"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}