{"record":{"id":"cd33dcbdb819e732","repo":"prestodb/presto","slug":"error-setting-up-ssl","errorCode":null,"errorMessage":"Error setting up SSL: ","messagePattern":"Error setting up SSL: ","errorType":"exception","errorClass":"ClientException","httpStatus":null,"severity":"error","filePath":"presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java","lineNumber":175,"sourceCode":"                {\n                    // skip validation of server certificate\n                }\n\n                @Override\n                public X509Certificate[] getAcceptedIssuers()\n                {\n                    return new X509Certificate[0];\n                }\n            };\n\n            SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n            sslContext.init(null, new TrustManager[] {trustAllCerts}, new SecureRandom());\n\n            clientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustAllCerts);\n            clientBuilder.hostnameVerifier((hostname, session) -> true);\n        }\n        catch (GeneralSecurityException e) {\n            throw new ClientException(\"Error setting up SSL: \" + e.getMessage(), e);\n        }\n    }\n\n    public static void setupSsl(\n            OkHttpClient.Builder clientBuilder,\n            Optional<String> keyStorePath,\n            Optional<String> keyStorePassword,\n            Optional<String> keystoreType,\n            Optional<String> trustStorePath,\n            Optional<String> trustStorePassword,\n            Optional<String> trustStoreType)\n    {\n        if (!keyStorePath.isPresent() && !trustStorePath.isPresent()) {\n            return;\n        }\n\n        try {\n            // load KeyStore if configured and get KeyManagers","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java#L157-L193","documentation":"OkHttpUtil.setupInsecureSsl installs a trust-all TrustManager to allow HTTPS to servers without valid certificates. Building that SSLContext (KeyManagerFactory, TrustManagerFactory, or sslContext.init) can throw a GeneralSecurityException, which the library wraps in this ClientException with the underlying message appended.","triggerScenarios":"Calling setupInsecureSsl on a JVM where the security provider cannot create the trust-all TrustManager or initialize the SSLContext — e.g. broken JCE provider configuration, restricted crypto policy, or corrupted keystore/truststore defaults on the classpath.","commonSituations":"Custom java.security files overriding security providers; unusual JDKs (limited crypto builds); ClassLoader picking up a bad keystore via javax.net.ssl defaults; running in a stripped-down container missing TLS provider JARs.","solutions":["Read the wrapped exception's message/cause (ClientException.getCause()) to identify which security setup step failed.","Verify the JVM's security providers with a minimal TLS smoke test (SSLContext.getInstance(\"TLS\").init(...)) outside Presto.","Remove or fix custom java.security / provider overrides and ensure standard JCE providers are present.","As a fallback, skip setupInsecureSsl and rely on a properly configured truststore via setupSsl with valid certs."],"exampleFix":"// before\nOkHttpUtil.setupInsecureSsl(builder, Optional.empty()); // ClientException: Error setting up SSL\n// after\ntry {\n    OkHttpUtil.setupInsecureSsl(builder, Optional.empty());\n} catch (ClientException e) {\n    LOG.warn(\"Insecure SSL setup failed: {}\", e.getCause(), e);\n    throw e;\n}","handlingStrategy":"try-catch","validationCode":"try { SSLContext.getInstance(\"TLS\"); TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); } catch (GeneralSecurityException e) { /* JCE/provider environment is broken; fix JDK security config before enabling insecure SSL */ }","typeGuard":null,"tryCatchPattern":"try { OkHttpUtil.setupInsecureSsl(builder, Optional.empty()); } catch (ClientException e) { /* inspect e.getCause() (GeneralSecurityException) and fix providers/policies */ }","preventionTips":["Keep the JDK's default security providers intact (no custom java.security overrides)","Use a full-featured JDK with standard JCE providers in containers","Check ClientException.getCause() to pinpoint the failing security step","Prefer a proper truststore via setupSsl over trust-all in production"],"tags":["ssl","tls","presto-client","security","configuration"],"backgroundTag":"ssl-setup-failure","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}