{"record":{"id":"c4a90add1fe1f5f0","repo":"apache/seatunnel","slug":"unexpected-default-trust-managers","errorCode":null,"errorMessage":"Unexpected default trust managers:","messagePattern":"Unexpected default trust managers:","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java","lineNumber":111,"sourceCode":"            keyManagers = keyManagerFactory.getKeyManagers();\n        }\n\n        // load TrustStore if configured, otherwise use KeyStore\n        KeyStore trustStore = keyStore;\n        if (trustStorePath.isPresent()) {\n            File trustStoreFile = new File(trustStorePath.get());\n            trustStore = loadTrustStore(trustStoreFile, trustStorePassword);\n        }\n\n        // create TrustManagerFactory\n        TrustManagerFactory trustManagerFactory =\n                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n        trustManagerFactory.init(trustStore);\n\n        // get X509TrustManager\n        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n            throw new RuntimeException(\n                    \"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n        }\n        // create SSLContext\n        SSLContext result = SSLContext.getInstance(\"SSL\");\n        result.init(keyManagers, trustManagers, null);\n        return result;\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws IOException, GeneralSecurityException {\n        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n        try {\n            // attempt to read the trust store as a PEM file\n            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);\n            if (!certificateChain.isEmpty()) {\n                trustStore.load(null, null);\n                for (X509Certificate certificate : certificateChain) {\n                    X500Principal principal = certificate.getSubjectX500Principal();","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-easysearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/easysearch/util/SSLUtils.java#L93-L129","documentation":"SSLUtils.createSSLContext (via buildSSLContext) initializes a TrustManagerFactory from the given trust store and expects exactly one X509TrustManager. If the JDK/provider returns zero or multiple trust managers, or a non-X509 one, it throws RuntimeException 'Unexpected default trust managers: ...'.","triggerScenarios":"buildSSLContext called with a trustStore whose default-algorithm TrustManagerFactory yields an unexpected manager array — typically a non-standard security provider, a trustStore containing unusual entries, or exotic JDK/vendor implementations.","commonSituations":"Running on an unusual JRE (IBM/OpenJ9 or old JDK) where getDefaultAlgorithm resolves differently; a custom java.security security.provider registration; FIPS providers returning extra trust managers.","solutions":["Check Arrays.toString output in the message to see what managers were returned; identify the offending security provider.","Switch to a standard JDK (Temurin/OpenJDK 8/11/17) with default security providers.","Remove custom security.provider entries from java.security that override TrustManagerFactory behavior.","Patch SSLUtils to pick the first X509TrustManager from the array instead of requiring length == 1."],"exampleFix":"// before\nif (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) throw ...\n// after\nX509TrustManager x509 = Arrays.stream(trustManagers)\n    .filter(tm -> tm instanceof X509TrustManager)\n    .map(tm -> (X509TrustManager) tm).findFirst()\n    .orElseThrow(() -> new RuntimeException(\"no X509TrustManager\"));","handlingStrategy":"validation","validationCode":"// Java: pre-flight trust manager check\nTrustManager[] tms = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).getTrustManagers();\nboolean ok = tms != null && tms.length == 1 && tms[0] instanceof X509TrustManager;\nif (!ok) throw new IllegalStateException(\"JDK provider returns non-standard trust managers: \" + Arrays.toString(tms));","typeGuard":null,"tryCatchPattern":"try { sslContext = SSLUtils.buildSSLContext(...); } catch (RuntimeException e) { if (e.getMessage().startsWith(\"Unexpected default trust managers\")) { log.error(\"Non-standard JDK security provider: {}\", e.getMessage()); throw e; } throw e; }","preventionTips":["Use a mainstream OpenJDK/Temurin build with default security providers","Avoid custom security.provider overrides in java.security for the job JVM","Log the trust manager array early when enabling TLS to catch provider issues"],"tags":["easysearch","ssl","tls"],"backgroundTag":"tls-trust-manager-error","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}