{"record":{"id":"dc173899c3d1647b","repo":"apache/beam","slug":"can-t-load-the-client-certificate-from-the-keystore","errorCode":null,"errorMessage":"Can't load the client certificate from the keystore","messagePattern":"Can't load the client certificate from the keystore","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/elasticsearch/src/main/java/org/apache/beam/sdk/io/elasticsearch/ElasticsearchIO.java","lineNumber":708,"sourceCode":"      builder.addIfNotNull(DisplayData.item(\"socketTimeout\", getSocketTimeout()));\n      builder.addIfNotNull(DisplayData.item(\"connectTimeout\", getConnectTimeout()));\n      builder.addIfNotNull(DisplayData.item(\"trustSelfSignedCerts\", isTrustSelfSignedCerts()));\n      builder.addIfNotNull(DisplayData.item(\"compressionEnabled\", isCompressionEnabled()));\n    }\n\n    private SSLContext getSSLContext() throws IOException {\n      if (getKeystorePath() != null && !getKeystorePath().isEmpty()) {\n        try {\n          KeyStore keyStore = KeyStore.getInstance(\"jks\");\n          try (InputStream is = new FileInputStream(new File(getKeystorePath()))) {\n            String keystorePassword = getKeystorePassword();\n            keyStore.load(is, (keystorePassword == null) ? null : keystorePassword.toCharArray());\n          }\n          final TrustStrategy trustStrategy =\n              isTrustSelfSignedCerts() ? new TrustSelfSignedStrategy() : null;\n          return SSLContexts.custom().loadTrustMaterial(keyStore, trustStrategy).build();\n        } catch (Exception e) {\n          throw new IOException(\"Can't load the client certificate from the keystore\", e);\n        }\n      }\n      return null;\n    }\n\n    @VisibleForTesting\n    RestClient createClient() throws IOException {\n      HttpHost[] hosts = new HttpHost[getAddresses().size()];\n      int i = 0;\n      for (String address : getAddresses()) {\n        URL url = new URL(address);\n        hosts[i] = new HttpHost(url.getHost(), url.getPort(), url.getProtocol());\n        i++;\n      }\n      RestClientBuilder restClientBuilder = RestClient.builder(hosts);\n      if (getPathPrefix() != null) {\n        restClientBuilder.setPathPrefix(getPathPrefix());\n      }","sourceCodeStart":690,"sourceCodeEnd":726,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/elasticsearch/src/main/java/org/apache/beam/sdk/io/elasticsearch/ElasticsearchIO.java#L690-L726","documentation":"ConnectionConfiguration.getSSLContext() builds an SSLContext from a provided keystore to secure TLS connections to Elasticsearch. Any exception while loading the keystore file or the trust material (bad password, corrupt/malformed file, unreadable path) is rethrown as an IOException with this message, wrapping the underlying cause.","triggerScenarios":"ConnectionConfiguration.setKeystorePath(...)/setKeystorePassword(...) set to a nonexistent, corrupt, or password-protected keystore; wrong keystore password; keystore bytes not loadable as a KeyStore.","commonSituations":"Typo in keystore path in deployment config; keystore regenerated with a different password; secret mounted empty in Kubernetes; JKS vs PKCS12 format mismatch.","solutions":["Check the wrapped cause in the exception for the exact keystore failure reason","Verify keystorePath points to an existing, readable keystore file","Confirm keystorePassword matches the keystore's actual password","Validate the keystore with `keytool -list -keystore <path>` before deploying","Ensure the keystore format matches KeyStore.getDefaultType() (JKS vs PKCS12)"],"exampleFix":"// before\nConnectionConfiguration.create(\"es-host\", 9200)\n    .setKeystorePath(\"/secrets/keystore.jks\").setKeystorePassword(null);\n// after\nConnectionConfiguration.create(\"es-host\", 9200)\n    .setKeystorePath(\"/secrets/keystore.jks\").setKeystorePassword(keystorePassword);","handlingStrategy":"validation","validationCode":"File ks = new File(keystorePath);\nif (!ks.isFile() || !ks.canRead())\n  throw new IllegalArgumentException(\"Keystore missing/unreadable: \" + keystorePath);\ntry (InputStream in = new FileInputStream(ks)) {\n  KeyStore.getInstance(\"PKCS12\").load(in, password.toCharArray()); // throws if bad\n}","typeGuard":null,"tryCatchPattern":"try {\n  pipeline.apply(ElasticsearchIO.read().withConnectionConfiguration(cc));\n} catch (IllegalArgumentException | IOException e) {\n  throw new IllegalStateException(\"ES TLS setup failed: \" + e.getCause(), e);\n}","preventionTips":["Run keytool -list against the keystore in CI before deploying","Store keystore passwords in a secret manager, not config files","Pin the keystore format explicitly (JKS vs PKCS12)"],"tags":["java","elasticsearch","ssl","keystore","tls"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}