{"record":{"id":"ed60f266b73e1962","repo":"prestodb/presto","slug":"unexpected-default-trust-managers","errorCode":null,"errorMessage":"Unexpected default trust managers:","messagePattern":"Unexpected default trust managers:","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java","lineNumber":233,"sourceCode":"                keyManagerFactory.init(keyStore, keyManagerPassword);\n                keyManagers = keyManagerFactory.getKeyManagers();\n            }\n\n            // load TrustStore if configured, otherwise use KeyStore\n            KeyStore trustStore = keyStore;\n            if (trustStorePath.isPresent()) {\n                checkArgument(trustStoreType.isPresent(), \"truststore type is not present\");\n                trustStore = loadTrustStore(Paths.get(trustStorePath.get()).toFile(), trustStorePassword, trustStoreType.get());\n            }\n\n            // create TrustManagerFactory\n            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            trustManagerFactory.init(trustStore);\n\n            // get X509TrustManager\n            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n            if ((trustManagers.length != 1) || !(trustManagers[0] instanceof X509TrustManager)) {\n                throw new RuntimeException(\"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n            }\n            X509TrustManager trustManager = (X509TrustManager) trustManagers[0];\n\n            // create SSLContext\n            SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n            sslContext.init(keyManagers, new TrustManager[] {trustManager}, null);\n\n            clientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustManager);\n            clientBuilder.hostnameVerifier(LegacyHostnameVerifier.INSTANCE);\n        }\n        catch (GeneralSecurityException | IOException e) {\n            throw new ClientException(\"Error setting up SSL: \" + e.getMessage(), e);\n        }\n    }\n\n    private static void validateCertificates(KeyStore keyStore)\n            throws GeneralSecurityException\n    {","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java#L215-L251","documentation":"setupSsl initializes a TrustManagerFactory from the configured trust store and expects the default algorithm to yield exactly one TrustManager of type X509TrustManager. If the JDK's default trust management produces zero, multiple, or non-X509 managers, this RuntimeException is thrown, since the HTTPS client can only work with a single X509TrustManager. It indicates the trust store type or JVM security providers are producing an unsupported TrustManager layout.","triggerScenarios":"Calling setupSsl (via setupSslHttpConfig/buildClient) with a trust store whose type/provider causes TrustManagerFactory.getTrustManagers() to return an array whose length != 1 or whose first element is not an X509TrustManager.","commonSituations":"Using an exotic trustStoreType (e.g. PKCS11 or a custom provider) registered in java.security; a JDK with non-standard security providers; a corrupted or unusual KeyStore implementation that returns composite trust managers.","solutions":["Use the standard trust store types JKS or PKCS12 for --truststore-type / trustStoreType.","Check the JVM's security providers (java.security file, installed providers) for overrides of TrustManagerFactory.","Test with a different JDK to rule out vendor-specific default trust manager behavior.","If a custom provider is required, ensure its TrustManagerFactory returns exactly one X509TrustManager."],"exampleFix":"// before\n--truststore-type=PKCS11\n// after\n--truststore-type=JKS","handlingStrategy":"validation","validationCode":"TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init(trustStore);\nTrustManager[] tms = tmf.getTrustManagers();\nif (tms.length != 1 || !(tms[0] instanceof X509TrustManager)) {\n    throw new IllegalStateException(\"Trust store yields non-X509 trust managers; use JKS/PKCS12\");\n}","typeGuard":null,"tryCatchPattern":"try { setupSsl(...); } catch (RuntimeException e) { if (e.getMessage().startsWith(\"Unexpected default trust managers\")) { /* switch store type/provider */ } else { throw e; } }","preventionTips":["Stick to JKS or PKCS12 trust store types","Avoid custom security providers unless necessary","Test TLS config on the target JDK before rollout"],"tags":["ssl","truststore","presto-client"],"backgroundTag":"unexpected-default-trust-managers","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}