{"record":{"id":"f554446989daedb1","repo":"SonarSource/sonarqube","slug":"unable-to-get-default-key-manager","errorCode":null,"errorMessage":"Unable to get default key manager","messagePattern":"Unable to get default key manager","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java","lineNumber":286,"sourceCode":"      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n      trustManagerFactory.init((KeyStore) null);\n      TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n      if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n        throw new IllegalStateException(\"Unexpected default trust managers:\" + Arrays.toString(trustManagers));\n      }\n      return (X509TrustManager) trustManagers[0];\n    } catch (GeneralSecurityException e) {\n      // The system has no TLS. Just give up.\n      throw new AssertionError(e);\n    }\n  }\n\n  private static SSLSocketFactory systemDefaultSslSocketFactory(X509TrustManager trustManager) {\n    KeyManager[] defaultKeyManager;\n    try {\n      defaultKeyManager = getDefaultKeyManager();\n    } catch (Exception e) {\n      throw new IllegalStateException(\"Unable to get default key manager\", e);\n    }\n    try {\n      SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(defaultKeyManager, new TrustManager[] {trustManager}, null);\n      return sslContext.getSocketFactory();\n    } catch (GeneralSecurityException e) {\n      // The system has no TLS. Just give up.\n      throw new AssertionError(e);\n    }\n  }\n\n  private static void logDebug(String msg) {\n    boolean debugEnabled = \"all\".equals(System.getProperty(\"javax.net.debug\"));\n    if (debugEnabled) {\n      System.out.println(msg);\n    }\n  }\n","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java#L268-L304","documentation":"IllegalStateException in OkHttpClientBuilder.systemDefaultSslSocketFactory: after initializing the JVM-default TrustManagerFactory, the code expects exactly one X509TrustManager; if the JRE's default trust manager setup is missing or unexpected (e.g. non-X509 managers, broken security provider configuration) the catch on GeneralSecurityException produces this failure while building the default SSL socket factory.","triggerScenarios":"Building the client via systemDefaultSslSocketFactory when system properties javax.net.ssl.keyStore/keyStoreType/keyStoreProvider point to a missing, unreadable, or corrupt keystore, or a bad provider.","commonSituations":"javax.net.ssl.keyStore pointing to a nonexistent or wrong-password file, malformed PKCS12 keystores, or missing security providers on stripped-down JVMs.","solutions":["Check the javax.net.ssl.keyStore, keyStoreType, keyStoreProvider and keyStorePassword system properties point to a valid keystore","Verify the keystore file exists, is readable, and the password is correct","Remove bogus keystore system properties so JVM defaults are used","Provide your own key manager / SSL socket factory to the builder"],"exampleFix":"// before\njava -Djavax.net.ssl.keyStore=/missing/keystore.jks -jar app.jar\n// after\njava -Djavax.net.ssl.keyStore=/etc/certs/client.p12 -Djavax.net.ssl.keyStorePassword=changeit -Djavax.net.ssl.keyStoreType=PKCS12 -jar app.jar","handlingStrategy":"validation","validationCode":"String ks = System.getProperty(\"javax.net.ssl.keyStore\");\nif (ks != null && !ks.isEmpty() && !java.nio.file.Files.isReadable(java.nio.file.Paths.get(ks))) {\n  throw new IllegalStateException(\"javax.net.ssl.keyStore not readable: \" + ks);\n}","typeGuard":null,"tryCatchPattern":"try {\n  SSLSocketFactory f = OkHttpClientBuilder.systemDefaultSslSocketFactory(tm);\n} catch (IllegalStateException e) {\n  if (e.getMessage().equals(\"Unable to get default key manager\")) {\n    LOG.error(\"Check javax.net.ssl.keyStore* properties\", e.getCause());\n  }\n}","preventionTips":["Verify javax.net.ssl.keyStore/keyStorePassword/keyStoreType before startup","Use PKCS12 keystores with correct passwords","Remove stale keystore system properties when not using client certificates","Provide explicit key managers in containerized/trimmed JVMs"],"tags":["ssl","tls","keystore","client-certificates"],"backgroundTag":"invalid-config-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}