{"record":{"id":"e34a46140c6141f3","repo":"apache/seatunnel","slug":"unexpected-default-trust-managers-e34a46","errorCode":null,"errorMessage":"Unexpected default trust managers:","messagePattern":"Unexpected default trust managers:","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java","lineNumber":111,"sourceCode":"            keyManagers = keyManagerFactory.getKeyManagers();\n        }\n\n        // load TrustStore if configured, otherwise use KeyStore\n        KeyStore trustStore = keyStore;\n        if (trustStorePath.isPresent()) {\n            File trustStoreFile = new File(trustStorePath.get());\n            trustStore = loadTrustStore(trustStoreFile, trustStorePassword);\n        }\n\n        // create TrustManagerFactory\n        TrustManagerFactory trustManagerFactory =\n                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n        trustManagerFactory.init(trustStore);\n\n        // get X509TrustManager\n        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n            throw new RuntimeException(\n                    \"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n        }\n        // create SSLContext\n        SSLContext result = SSLContext.getInstance(\"SSL\");\n        result.init(keyManagers, trustManagers, null);\n        return result;\n    }\n\n    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws IOException, GeneralSecurityException {\n        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n        try {\n            // attempt to read the trust store as a PEM file\n            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);\n            if (!certificateChain.isEmpty()) {\n                trustStore.load(null, null);\n                for (X509Certificate certificate : certificateChain) {\n                    X500Principal principal = certificate.getSubjectX500Principal();","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/util/SSLUtils.java#L93-L129","documentation":"SSLUtils.createSSLContext initializes the default TrustManagerFactory from the configured trust store and expects it to yield exactly one TrustManager that is an X509TrustManager. If the JDK/security provider returns a different set (multiple managers or a non-X509 type), this RuntimeException is thrown because the code cannot build the SSLContext it needs for HTTPS connections to Elasticsearch.","triggerScenarios":"Calling buildSSLContext when trustManagerFactory.getTrustManagers() returns an array with length != 1 or whose first element is not an X509TrustManager. Happens with unusual JCE security providers, custom crypto setups (e.g. IBM JDK, FIPS providers), or exotic trust store configurations.","commonSituations":"Running on a JDK or security provider (FIPS-enabled JVM, IBM JDK, custom java.security file) that registers multiple trust managers; corrupt or non-standard trust store entries; exotic SSL configurations in containerized environments.","solutions":["Run on a standard Oracle/OpenJDK/Temurin JDK with the default SUN security provider, where the default algorithm yields a single X509TrustManager.","Check java.security (securerandom/source and ssl.TrustManagerFactoryAlgorithm overrides) and remove custom TrustManagerFactory algorithm overrides.","If a FIPS or IBM JDK is required, supply a custom trust manager wrapper that picks the X509TrustManager from the array instead of relying on this utility.","Inspect the exception's Arrays.toString(trustManagers) output to identify which provider returned the unexpected managers."],"exampleFix":"// before (JDK with multiple trust managers)\nSSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);\n// after (pick the X509TrustManager explicitly in a custom utility)\nX509TrustManager x509 = (X509TrustManager) Arrays.stream(trustManagerFactory.getTrustManagers())\n        .filter(tm -> tm instanceof X509TrustManager).findFirst()\n        .orElseThrow(() -> new RuntimeException(\"No X509TrustManager found\"));\nsslContext.init(keyManagers, new TrustManager[]{x509}, null);","handlingStrategy":"try-catch","validationCode":"// Verify the default trust managers before building the SSL context\nTrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init((KeyStore) null);\nfor (TrustManager tm : tmf.getTrustManagers()) {\n    if (!(tm instanceof X509TrustManager)) {\n        throw new IllegalStateException(\"Provider returns non-X509 trust managers: \" + tm);\n    }\n}","typeGuard":"boolean hasSingleX509TrustManager(TrustManager[] tms) {\n    return tms != null && tms.length == 1 && tms[0] instanceof X509TrustManager;\n}","tryCatchPattern":"try {\n    SSLContext ctx = SSLUtils.buildSSLContext(trustStore, keyStore, password);\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Unexpected default trust managers\")) {\n        log.error(\"JDK/security provider returned unsupported TrustManagers; switch to a standard JDK\", e);\n    }\n    throw e;\n}","preventionTips":["Use standard OpenJDK/Temurin builds without FIPS or custom security providers for SeaTunnel workers.","Do not override ssl.TrustManagerFactoryAlgorithm in java.security.","Log the TrustManager array from getTrustManagers() when configuring SSL to detect provider issues early."],"tags":["ssl","tls","elasticsearch","jdk-compatibility"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}