{"record":{"id":"d68fffcdf13e78b3","repo":"prestodb/presto","slug":"truststore-is-empty-no-trusted-certificates-foun","errorCode":null,"errorMessage":"Truststore is empty - no trusted certificates found","messagePattern":"Truststore is empty - no trusted certificates found","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java","lineNumber":184,"sourceCode":"    {\n        char[] keyManagerPassword = keystorePassword.map(String::toCharArray).orElse(null);\n        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(getDefaultAlgorithm());\n        keyManagerFactory.init(keystore, keyManagerPassword);\n        return keyManagerFactory.getKeyManagers();\n    }\n\n    private X509TrustManager createTrustManager(KeyStore truststore) throws GeneralSecurityException\n    {\n        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(getDefaultAlgorithm());\n\n        // When truststore is null, TrustManagerFactory will use JVM's system default truststore\n        // When truststore is not null, validate it contains certificates before using it\n        if (truststore != null) {\n            try {\n                // Check if truststore has any certificates\n                List<String> aliases = Collections.list(truststore.aliases());\n                if (aliases.isEmpty()) {\n                    throw new GeneralSecurityException(\"Truststore is empty - no trusted certificates found\");\n                }\n                log.debug(\"Truststore contains {} certificate(s): {}\", aliases.size(), aliases);\n            }\n            catch (KeyStoreException e) {\n                throw new GeneralSecurityException(\"Failed to read truststore\", e);\n            }\n        }\n\n        trustManagerFactory.init(truststore);\n\n        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n            throw new RuntimeException(\"Unexpected default trust managers: \" + Arrays.toString(trustManagers));\n        }\n\n        return (X509TrustManager) trustManagers[0];\n    }\n","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java#L166-L202","documentation":"createTrustManager defensively validates that a loaded KeyStore actually contains at least one certificate alias before handing it to the TrustManagerFactory. An empty truststore would silently trust nothing (or fail later), so the provider throws GeneralSecurityException('Truststore is empty - no trusted certificates found') early.","triggerScenarios":"createTrustManager (via trustManager) receives a non-null truststore whose Collections.list(truststore.aliases()) is empty — the file loaded successfully but held no certificate entries, e.g. an empty file or wrong password creating a fresh empty store.","commonSituations":"Mounting an empty placeholder file at the truststore path in Kubernetes; wrong password causing some loaders to yield an empty store; a PEM file containing only a private key with no certificates; truncated file after a bad secret update.","solutions":["Check the truststore file contents (keytool -list -v -keystore truststore.jks or openssl on the PEM) and confirm it has certificates","Re-export/import the CA certificates into the truststore (keytool -importcert)","Fix the secret/volume mount so the real truststore file is present at the configured path","Verify the password — a wrong password can result in an empty store rather than an error"],"exampleFix":"// verify before deploy\nkeytool -list -v -keystore /etc/presto/truststore.jks -storepass $TS_PASS\n// expect: 'Your keystore contains N entries' with N >= 1","handlingStrategy":"validation","validationCode":"# ensure the truststore actually contains certificates before use\nkeytool -list -keystore truststore.jks -storepass $TS_PASS | grep -q 'Your keystore contains [1-9]' || echo EMPTY","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail deployment if truststore file size is 0 or keytool lists zero entries","Include CA certificates (not just private keys) in PEM bundles","Verify Kubernetes secret mounts resolved to the real file"],"tags":["presto","ssl","truststore","tls"],"backgroundTag":"empty-truststore","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}