{"record":{"id":"c444f81ee1960cdd","repo":"prestodb/presto","slug":"unexpected-default-trust-managers-c444f8","errorCode":null,"errorMessage":"Unexpected default trust managers:","messagePattern":"Unexpected default trust managers:","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java","lineNumber":336,"sourceCode":"                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());\n                keyManagerFactory.init(keyStore, keyManagerPassword);\n                keyManagers = keyManagerFactory.getKeyManagers();\n            }\n\n            // load TrustStore if configured, otherwise use KeyStore\n            KeyStore trustStore = keyStore;\n            if (trustStorePath.isPresent()) {\n                trustStore = loadTrustStore(trustStorePath.get(), trustStorePassword);\n            }\n\n            // create TrustManagerFactory\n            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            trustManagerFactory.init(trustStore);\n\n            // get X509TrustManager\n            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n            if ((trustManagers.length != 1) || !(trustManagers[0] instanceof X509TrustManager)) {\n                throw new RuntimeException(\"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n            }\n            X509TrustManager trustManager = (X509TrustManager) trustManagers[0];\n\n            // create SSLContext\n            SSLContext result = SSLContext.getInstance(\"TLS\");\n            result.init(keyManagers, new TrustManager[] {trustManager}, null);\n            return Optional.of(result);\n        }\n        catch (GeneralSecurityException | IOException e) {\n            throw new PrestoException(ELASTICSEARCH_SSL_INITIALIZATION_FAILURE, e);\n        }\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws IOException, GeneralSecurityException\n    {\n        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n        try {","sourceCodeStart":318,"sourceCodeEnd":354,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-elasticsearch/src/main/java/com/facebook/presto/elasticsearch/client/ElasticsearchClient.java#L318-L354","documentation":"buildSslContext initializes a TrustManagerFactory from the configured truststore and expects the default algorithm to produce exactly one trust manager that is an X509TrustManager. If the array is empty, has multiple entries, or is of a different class, the code cannot build the TLS context for the Elasticsearch client and throws RuntimeException. This indicates the truststore is empty, corrupt, or contains entries the default algorithm cannot consolidate.","triggerScenarios":"Configuring elasticsearch.security.truststore (or keystore path) pointing to a keystore that is empty, wrong format, unreadable, or whose default TrustManagerFactory result is not a single X509TrustManager.","commonSituations":"Wrong truststore path or password; truststore created with an unusual type (e.g. PKCS12 vs JKS mismatch); file mounted empty in Kubernetes secret; Java security providers overridden.","solutions":["Verify the truststore file exists, is a valid JKS/PKCS12 keystore, and actually contains the CA certificate (keytool -list -v -keystore truststore.jks).","Check elasticsearch.security.truststore-password is correct; an empty keystore yields no usable trust managers.","Re-create the truststore by importing the server CA: keytool -importcert -alias es-ca -file ca.crt -keystore truststore.jks.","Upgrade the connector / JDK so the default algorithm returns an X509TrustManager."],"exampleFix":"// before (empty/garbage file mounted)\nelasticsearch.security.truststore=/secrets/tls (empty file)\n// after\nkeytool -importcert -alias es-ca -file ca.pem -keystore /secrets/truststore.jks -storepass changeit\nelasticsearch.security.truststore=/secrets/truststore.jks","handlingStrategy":"validation","validationCode":"// verify the truststore before configuring Presto\nkeytool -list -v -keystore /etc/presto/es-truststore.jks -storepass $PASS\n# expect at least one trustedCertEntry; exit code 0 and non-empty output","typeGuard":null,"tryCatchPattern":"// wrap connector bootstrap\ntry {\n    connector = esConnectorFactory.create(...);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unexpected default trust managers:\")) {\n        throw new ConfigurationException(\"truststore empty/corrupt: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Always keytool -list the truststore after creating/mounting it.","Use JKS or PKCS12 explicitly and match the file format.","Mount Kubernetes secrets with correct file contents, not emptyDirs.","Keep truststore password in a secret manager, verify with a startup check."],"tags":["elasticsearch","ssl","tls","truststore","configuration"],"backgroundTag":"invalid-truststore","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}