{"record":{"id":"e62af94fc801021b","repo":"SonarSource/sonarqube","slug":"unexpected-default-trust-managers","errorCode":null,"errorMessage":"Unexpected default trust managers:","messagePattern":"Unexpected default trust managers:","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java","lineNumber":272,"sourceCode":"\n  private Response addHeaders(Interceptor.Chain chain) throws IOException {\n    Request.Builder newRequest = chain.request().newBuilder();\n    if (userAgent != null) {\n      newRequest.header(\"User-Agent\", userAgent);\n    }\n    if (credentials != null) {\n      newRequest.header(\"Authorization\", credentials);\n    }\n    return chain.proceed(newRequest.build());\n  }\n\n  private static X509TrustManager systemDefaultTrustManager() {\n    try {\n      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n      trustManagerFactory.init((KeyStore) null);\n      TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n        throw new IllegalStateException(\"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n      }\n      return (X509TrustManager) trustManagers[0];\n    } catch (GeneralSecurityException e) {\n      // The system has no TLS. Just give up.\n      throw new AssertionError(e);\n    }\n  }\n\n  private static SSLSocketFactory systemDefaultSslSocketFactory(X509TrustManager trustManager) {\n    KeyManager[] defaultKeyManager;\n    try {\n      defaultKeyManager = getDefaultKeyManager();\n    } catch (Exception e) {\n      throw new IllegalStateException(\"Unable to get default key manager\", e);\n    }\n    try {\n      SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(defaultKeyManager, new TrustManager[] {trustManager}, null);","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java#L254-L290","documentation":"The JVM's default TrustManagerFactory did not yield exactly one trust manager, or that manager was not an X509TrustManager. OkHttpClientBuilder requires a single X509TrustManager to build the HTTPS client, so it fails fast with IllegalStateException.","triggerScenarios":"Calling OkHttpClientBuilder.build() (via trustManager/systemDefaultTrustManager) on a JVM whose default trust store resolves to zero, multiple, or non-X509 trust managers — typically when the 'ssl.TrustManagerFactory.algorithm' security property or javax.net.ssl setup is customized.","commonSituations":"Custom java.security configurations, exotic JDKs or FIPS/security providers overriding the default trust algorithm, or embedded JVMs with no system CA store.","solutions":["Inspect TrustManagerFactory.getDefaultAlgorithm() and the trust managers it returns on the affected JVM","Remove or fix custom 'ssl.TrustManagerFactory.algorithm' settings in java.security or provider overrides","Ensure the default KeyStore (javax.net.ssl.trustStore) is readable and valid","Explicitly configure the builder with your own trust manager/SSL socket factory instead of relying on system defaults"],"exampleFix":"// before\nOkHttpClient client = new OkHttpClientBuilder().build(); // JVM default trust store broken\n// after\nX509TrustManager tm = loadCustomTrustManager(\"/path/truststore.jks\", \"changeit\");\nOkHttpClient client = new OkHttpClientBuilder().setTrustManager(tm).build();","handlingStrategy":"validation","validationCode":"TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init((KeyStore) null);\nTrustManager[] tms = tmf.getTrustManagers();\nif (tms.length != 1 || !(tms[0] instanceof X509TrustManager)) {\n  throw new IllegalStateException(\"JVM default trust store unusable: \" + Arrays.toString(tms));\n}","typeGuard":null,"tryCatchPattern":"try {\n  OkHttpClient client = new OkHttpClientBuilder().build();\n} catch (IllegalStateException e) {\n  if (e.getMessage().contains(\"Unexpected default trust managers\")) {\n    // fall back to explicitly configured trust manager\n  }\n}","preventionTips":["Avoid overriding ssl.TrustManagerFactory.algorithm in java.security","Keep the default JVM cacerts truststore intact and readable","Test HTTPS connectivity on the exact JDK/runtime used in production","Configure an explicit trust manager when using custom security providers"],"tags":["ssl","tls","truststore","jvm-config"],"backgroundTag":"invalid-config-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}