{"record":{"id":"e16e9ca697fc96dd","repo":"elastic/elasticsearch","slug":"security-exception","errorCode":null,"errorMessage":"security exception","messagePattern":"security exception","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchCluster.java","lineNumber":667,"sourceCode":"                    getFirstNode().getHttpSocketURI(),\n                    nodes.size()\n                );\n                if (httpSslEnabled) {\n                    getFirstNode().configureHttpWait(wait);\n                }\n                List<Map<String, String>> credentials = getFirstNode().getCredentials();\n                if (getFirstNode().getCredentials().isEmpty() == false) {\n                    wait.setUsername(credentials.get(0).get(\"useradd\"));\n                    wait.setPassword(credentials.get(0).get(\"-p\"));\n                }\n                return wait.wait(500);\n            } catch (IOException e) {\n                throw new UncheckedIOException(\"IO error while waiting cluster\", e);\n            } catch (InterruptedException e) {\n                Thread.currentThread().interrupt();\n                throw new TestClustersException(\"Interrupted while waiting for \" + this, e);\n            } catch (GeneralSecurityException e) {\n                throw new RuntimeException(\"security exception\", e);\n            }\n        });\n    }\n\n    @Nested\n    public NamedDomainObjectContainer<ElasticsearchNode> getNodes() {\n        return nodes;\n    }\n\n    @Override\n    public boolean equals(Object o) {\n        if (this == o) return true;\n        if (o == null || getClass() != o.getClass()) return false;\n        ElasticsearchCluster that = (ElasticsearchCluster) o;\n        return Objects.equals(clusterName, that.clusterName) && Objects.equals(path, that.path);\n    }\n\n    @Override","sourceCodeStart":649,"sourceCodeEnd":685,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchCluster.java#L649-L685","documentation":"RuntimeException thrown from the cluster-health wait condition when WaitForHttpResource.wait raises a GeneralSecurityException. This typically means the HTTP wait attempted an SSL/TLS handshake (httpSslEnabled was true) and the TLS material or trust setup was invalid.","triggerScenarios":"httpSslEnabled is true, getFirstNode().configureHttpWait(wait) installs TLS material, and wait.wait(500) performs an HTTPS request whose handshake fails with a cert/key/trust error. Original GeneralSecurityException is the cause.","commonSituations":"Mismatched or expired test certificates, wrong keystore password, missing CA trust, JDK security policy disabling an algorithm used by the test cert.","solutions":["Inspect the wrapped GeneralSecurityException cause (e.g. SSLHandshakeException, CertPathBuilderException) for the specific failure.","Regenerate the test security fixtures (./gradlew :x-pack:plugin:core:internalClusterTest preparatory tasks or the security fixture tasks).","Confirm SSL settings handed to configureHttpWait match the node's actual keystore/truststore configuration.","On newer JDKs, check java.security for disabled algorithms (e.g. legacy TLS) affecting test certs."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Verify the node's keystore/truststore is readable before the wait\nPath ks = node.getConfigDir().resolve(\"certs/http.p12\");\nif (!Files.exists(ks)) {\n    throw new IllegalStateException(\"HTTP keystore missing; regenerate security fixtures\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    cluster.start();\n} catch (RuntimeException e) {\n    if (e.getCause() instanceof GeneralSecurityException gse) {\n        // regenerate test certs and rerun\n        throw new IllegalStateException(\"TLS material invalid — run security fixture tasks\", gse);\n    }\n    throw e;\n}","preventionTips":["Keep test security fixtures regenerated alongside JDK upgrades.","Verify keystore passwords and CA trust are consistent across nodes.","Check java.security for disabled algorithms affecting test certs."],"tags":["test","testclusters","ssl","security","wait-conditions"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}