{"record":{"id":"f383d1f788a4640d","repo":"SonarSource/sonarqube","slug":"failed-to-setup-ssl-context-on-es-client","errorCode":null,"errorMessage":"Failed to setup SSL context on ES client","messagePattern":"Failed to setup SSL context on ES client","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"server/sonar-main/src/main/java/org/sonar/application/es/EsConnectorImpl.java","lineNumber":182,"sourceCode":"      if (\"true\".equalsIgnoreCase(System.getProperty(\"java.net.preferIPv6Addresses\"))) {\n        return new HttpHost(scheme, address, host.getHost(), host.getPortOrDefault(9001));\n      }\n      return new HttpHost(scheme, address, host.getPortOrDefault(9001));\n    } catch (UnknownHostException e) {\n      throw new IllegalStateException(\"Can not resolve host [\" + host + \"]\", e);\n    }\n  }\n\n  private static SSLContext getSSLContext(Path keyStorePath, @Nullable String keyStorePassword) {\n    try {\n      KeyStore keyStore = KeyStore.getInstance(\"pkcs12\");\n      try (InputStream is = Files.newInputStream(keyStorePath)) {\n        keyStore.load(is, keyStorePassword == null ? null : keyStorePassword.toCharArray());\n      }\n      SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(keyStore, null);\n      return sslBuilder.build();\n    } catch (IOException | GeneralSecurityException e) {\n      throw new IllegalStateException(\"Failed to setup SSL context on ES client\", e);\n    }\n  }\n\n  /**\n   * Holds the ES client together with the underlying Rest5Client so we can close the latter on stop().\n   */\n  private record EsClient(Rest5Client restClient, ElasticsearchClient client) {\n  }\n}\n","sourceCodeStart":164,"sourceCodeEnd":192,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-main/src/main/java/org/sonar/application/es/EsConnectorImpl.java#L164-L192","documentation":"getSSLContext loads a PKCS12 key store from disk and builds an SSLContext for the Elasticsearch REST client. Any IOException (missing/unreadable keystore file) or GeneralSecurityException (bad password, invalid keystore format) is wrapped in IllegalStateException 'Failed to setup SSL context on ES client'.","triggerScenarios":"Building the ES HTTPS client when the configured keystore path does not exist, is not a valid PKCS12 file, or the provided keyStorePassword is wrong.","commonSituations":"Using a JKS keystore where PKCS12 is required; a wrong or missing keystore password; the keystore file not being mounted/copied into the deployment; corrupted keystore files.","solutions":["Verify the keystore file exists and is readable at the configured path","Convert the keystore to PKCS12: keytool -importkeystore -srckeystore ks.jks -deststoretype pkcs12","Check/correct the keystore password configured for the ES client","Regenerate the keystore if the file is corrupted"],"exampleFix":"// before: JKS keystore\nkeytool -genkeypair -keystore es-keystore.jks\n// after: PKCS12 as required\nkeytool -importkeystore -srckeystore es-keystore.jks -destkeystore es-keystore.p12 -deststoretype pkcs12","handlingStrategy":"try-catch","validationCode":"Path ks = Paths.get(keyStorePath);\nif (!Files.isReadable(ks)) throw new IllegalStateException(\"ES keystore unreadable: \" + ks);\n// optionally probe: KeyStore.getInstance(\"pkcs12\").load(Files.newInputStream(ks), password)","typeGuard":"static boolean validPkcs12(Path p, String pw) { try (InputStream in = Files.newInputStream(p)) { KeyStore.getInstance(\"pkcs12\").load(in, pw == null ? null : pw.toCharArray()); return true; } catch (Exception e) { return false; } }","tryCatchPattern":"try { esConnector.start(); } catch (IllegalStateException e) { if (e.getMessage().contains(\"Failed to setup SSL context\")) { verifyKeystore(); } throw e; }","preventionTips":["Use PKCS12 format keystores for the ES client","Pre-probe the keystore with keytool/KeyStore.load before startup","Mount the keystore file into container deployments and verify presence","Store passwords in a secret manager and confirm they match the keystore"],"tags":["ssl","elasticsearch","keystore","security"],"backgroundTag":"file-open-failed","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}