{"record":{"id":"c6f14e80462c201a","repo":"elastic/elasticsearch","slug":"unexpected-exception-creating-messagedigest-instan","errorCode":null,"errorMessage":"unexpected exception creating MessageDigest instance for [{}]","messagePattern":"unexpected exception creating MessageDigest instance for \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslUtil.java","lineNumber":34,"sourceCode":"import java.util.Objects;\n\npublic final class SslUtil {\n\n    private SslUtil() {\n        // utility class\n    }\n\n    public static String calculateFingerprint(X509Certificate certificate, String algorithm) throws CertificateEncodingException {\n        final MessageDigest sha1 = messageDigest(algorithm);\n        sha1.update(certificate.getEncoded());\n        return toHexString(sha1.digest());\n    }\n\n    static MessageDigest messageDigest(String digestAlgorithm) {\n        try {\n            return MessageDigest.getInstance(digestAlgorithm);\n        } catch (NoSuchAlgorithmException e) {\n            throw new SslConfigException(\"unexpected exception creating MessageDigest instance for [\" + digestAlgorithm + \"]\", e);\n        }\n    }\n\n    private static final char[] HEX_DIGITS = \"0123456789abcdef\".toCharArray();\n\n    /**\n     * Format a byte array as a hex string.\n     *\n     * @param bytes the input to be represented as hex.\n     * @return a hex representation of the input as a String.\n     */\n    static String toHexString(byte[] bytes) {\n        return new String(toHexCharArray(bytes));\n    }\n\n    /**\n     * Encodes the byte array into a newly created hex char array, without allocating any other temporary variables.\n     *","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslUtil.java#L16-L52","documentation":"SslUtil.messageDigest requests a MessageDigest instance by algorithm name from the JCE; if no Provider supplies that algorithm, NoSuchAlgorithmException is wrapped in this SslConfigException. Used by calculateFingerprint to compute cert fingerprints for logging/diagnostics.","triggerScenarios":"calculateFingerprint is invoked with an algorithm name that MessageDigest.getInstance does not recognise — e.g. \"SHA256\" instead of \"SHA-256\", \"sha-3-256\", or a provider-specific name on a JVM that lacks the provider.","commonSituations":"Caller passes a non-standard digest name; BouncyCastle-specific algorithm used on a stock JDK; uppercase/spacing typo; FIPS-restricted JVM that disables MD5/SHA1.","solutions":["Use the standard JCE algorithm names: \"SHA-1\", \"SHA-256\", \"SHA-384\", \"SHA-512\" (note the hyphen).","List algorithms available on your JVM: Security.getAlgorithms(\"MessageDigest\").","If you need a non-default algorithm, install the provider (e.g. BouncyCastle) and confirm it is registered."],"exampleFix":"// before\nSslUtil.calculateFingerprint(cert, \"SHA256\");\n// after\nSslUtil.calculateFingerprint(cert, \"SHA-256\");","handlingStrategy":"validation","validationCode":"private static final Set<String> KNOWN_DIGESTS =\n    java.security.Security.getAlgorithms(\"MessageDigest\");\nString ensureDigest(String alg) {\n    if (!KNOWN_DIGESTS.contains(alg))\n        throw new IllegalArgumentException(\"Unknown MessageDigest algorithm: \" + alg + \"; available: \" + KNOWN_DIGESTS);\n    return alg;\n}","typeGuard":null,"tryCatchPattern":"try {\n    String fp = SslUtil.calculateFingerprint(cert, alg);\n} catch (SslConfigException e) {\n    if (e.getCause() instanceof NoSuchAlgorithmException)\n        throw new IllegalArgumentException(\"Unsupported digest algorithm: \" + alg, e);\n    throw e;\n}","preventionTips":["Use standard JCE names with the hyphen: SHA-1, SHA-256, SHA-384, SHA-512.","If using provider-specific algorithms, register the provider and assert it is present.","Cache Security.getAlgorithms(\"MessageDigest\") at startup to whitelist acceptable names."],"tags":["ssl","cryptography","message-digest","config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}