{"record":{"id":"d967452fd859781a","repo":"elastic/elasticsearch","slug":"failed-to-find-a-x509extendedtrustmanager-in-the-t","errorCode":null,"errorMessage":"failed to find a X509ExtendedTrustManager in the trust manager factory for [{}] and truststore [{}]","messagePattern":"failed to find a X509ExtendedTrustManager in the trust manager factory for \\[(.+?)\\] and truststore \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java","lineNumber":179,"sourceCode":"        throw new SslConfigException(\n            \"failed to find a X509ExtendedKeyManager in the key manager factory for [\" + algorithm + \"] and keystore [\" + keyStore + \"]\"\n        );\n    }\n\n    /**\n     * Creates a {@link X509ExtendedTrustManager} based on the trust material in the provided {@link KeyStore}\n     */\n    public static X509ExtendedTrustManager createTrustManager(@Nullable KeyStore trustStore, String algorithm)\n        throws NoSuchAlgorithmException, KeyStoreException {\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);\n        tmf.init(trustStore);\n        TrustManager[] trustManagers = tmf.getTrustManagers();\n        for (TrustManager trustManager : trustManagers) {\n            if (trustManager instanceof X509ExtendedTrustManager x509ExtendedTrustManager) {\n                return x509ExtendedTrustManager;\n            }\n        }\n        throw new SslConfigException(\n            \"failed to find a X509ExtendedTrustManager in the trust manager factory for [\"\n                + algorithm\n                + \"] and truststore [\"\n                + trustStore\n                + \"]\"\n        );\n    }\n\n    /**\n     * Creates a {@link X509ExtendedTrustManager} based on the provided certificates\n     *\n     * @param certificates the certificates to trust\n     * @return a trust manager that trusts the provided certificates\n     */\n    public static X509ExtendedTrustManager createTrustManager(Collection<Certificate> certificates) throws GeneralSecurityException {\n        KeyStore store = buildTrustStore(certificates);\n        return createTrustManager(store, TrustManagerFactory.getDefaultAlgorithm());\n    }","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java#L161-L197","documentation":"Thrown by KeyStoreUtil.createTrustManager() when TrustManagerFactory.getTrustManagers() returns no X509ExtendedTrustManager. The trust store initialised but the factory did not yield an X.509-capable trust manager, so TLS handshake validation has nothing to use.","triggerScenarios":"createTrustManager(trustStore, algorithm): after tmf.init(trustStore) and iterating, none of trustManagers is an X509ExtendedTrustManager. Happens with non-default algorithms, third-party providers, or when trustStore is null on a JVM/provider that returns an empty manager array.","commonSituations":"xpack.security.transport.ssl.truststore.algorithm set to a custom value; BCFIPS or other FIPS provider whose TrustManagerFactory returns provider-specific types; null trust store passed to a provider that does not synthesise a default X.509 trust manager; misconfigured provider order.","solutions":["Leave the algorithm at its default (TrustManagerFactory.getDefaultAlgorithm(), usually PKIX).","If using a FIPS provider, follow Elastic FIPS docs to configure the truststore algorithm and provider.","Ensure the truststore is non-null and contains at least one certificate (`keytool -list -keystore ts.p12`).","Reorder providers in `java.security` so SunJSSE precedes third-party providers."],"exampleFix":"// before: custom algorithm yields non-X509 trust manager\nX509ExtendedTrustManager tm = KeyStoreUtil.createTrustManager(ts, \"X509\");\n\n// after: default algorithm\nX509ExtendedTrustManager tm = KeyStoreUtil.createTrustManager(\n    ts, TrustManagerFactory.getDefaultAlgorithm());","handlingStrategy":"validation","validationCode":"public static boolean algorithmReturnsX509Tm(String algorithm, KeyStore ts) throws Exception {\n    TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);\n    tmf.init(ts);\n    for (TrustManager tm : tmf.getTrustManagers()) {\n        if (tm instanceof X509ExtendedTrustManager) return true;\n    }\n    return false;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer the default algorithm (TrustManagerFactory.getDefaultAlgorithm()).","On FIPS providers, follow Elastic's FIPS docs for truststore algorithm.","Ensure the truststore contains at least one trusted certificate."],"tags":["ssl","keystore","trustmanager","jce","elasticsearch","crypto"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}