{"record":{"id":"d8b1cedd7da5cfcc","repo":"elastic/elasticsearch","slug":"exception-while-reloading-enterprise-geoip-downloa","errorCode":null,"errorMessage":"Exception while reloading enterprise geoip download task executor","messagePattern":"Exception while reloading enterprise geoip download task executor","errorType":"exception","errorClass":"ElasticsearchException","httpStatus":null,"severity":"error","filePath":"modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/EnterpriseGeoIpDownloaderTaskExecutor.java","lineNumber":183,"sourceCode":"                && event.changedCustomProjectMetadataSet().contains(IngestGeoIpMetadata.TYPE);\n            if (hasGeoIpMetadataChanges) {\n                // watching the cluster changed events to kick the thing off if it's not running\n                currentDownloader.requestRunOnDemand();\n            }\n        }\n    }\n\n    public synchronized void reload(Settings settings) {\n        // `SecureSettings` are available here! cache them as they will be needed\n        // whenever dynamic cluster settings change and we have to rebuild the accounts\n        try {\n            this.cachedSecureSettings = InMemoryClonedSecureSettings.cloneSecureSettings(\n                settings,\n                List.of(MAXMIND_LICENSE_KEY_SETTING, IPINFO_TOKEN_SETTING)\n            );\n        } catch (GeneralSecurityException e) {\n            // rethrow as a runtime exception, there's logging higher up the call chain around ReloadablePlugin\n            throw new ElasticsearchException(\"Exception while reloading enterprise geoip download task executor\", e);\n        }\n    }\n}\n","sourceCodeStart":165,"sourceCodeEnd":187,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/EnterpriseGeoIpDownloaderTaskExecutor.java#L165-L187","documentation":"Thrown by EnterpriseGeoIpDownloaderTaskExecutor.reload when cloning the secure settings for MAXMIND_LICENSE_KEY_SETTING and IPINFO_TOKEN_SETTING fails. InMemoryClonedSecureSettings.cloneSecureSettings performs crypto operations that can raise GeneralSecurityException; it is rethrown as an ElasticsearchException so the ReloadablePlugin machinery above can log and handle it. This blocks the downloader from picking up new credentials on settings reload.","triggerScenarios":"Plugin reload (settings change, or node restart re-reading the keystore) calls reload(settings) -> cloneSecureSettings throws GeneralSecurityException -> wrapped and rethrown.","commonSituations":"Corrupted or partially-restored elasticsearch.keystore; JVM security provider mismatch (FIPS mode, missing BouncyCastle); keystore encrypted with an algorithm the runtime cannot decrypt; secure settings version skew after an upgrade.","solutions":["Check the surrounding ReloadablePlugin log lines for the wrapped GeneralSecurityException cause (decrypt failure, algorithm not available, etc.).","Recreate the affected secure setting (elasticsearch-keystore remove + add for the maxmind/ipinfo keys).","Ensure the same security providers are available as when the keystore was created (no FIPS/non-FIPS flip, same JDK vendor).","Restart the node after keystore repair."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    executor.reload(settings);\n} catch (ElasticsearchException e) {\n    if (e.getMessage().startsWith(\"Exception while reloading\")) {\n        // inspect e.getCause() (GeneralSecurityException); recreate keystore entries, ensure security providers, restart\n    } else throw e;\n}","preventionTips":["Do not switch JDK security provider posture (FIPS/non-FIPS) without recreating the keystore.","Back up elasticsearch.keystore before upgrades.","Recreate maxmind/ipinfo secure settings after any keystore migration.","Watch ReloadablePlugin log lines around reload() for the wrapped cause."],"tags":["geoip","secure-settings","keystore","crypto","reload"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}