{"record":{"id":"faa74ca68fa9a278","repo":"redis/jedis","slug":"ssl-configuration-failed","errorCode":null,"errorMessage":"SSL configuration failed","messagePattern":"SSL configuration failed","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"src/main/java/redis/clients/jedis/mcf/RedisRestAPI.java","lineNumber":142,"sourceCode":"\n  HttpURLConnection createConnection(String urlString, String method, RedisCredentials credentials)\n      throws IOException {\n    URL url = new URL(urlString);\n    HttpURLConnection connection = (HttpURLConnection) url.openConnection();\n\n    // Configure SSL if this is an HTTPS connection and SSL options are provided\n    if (connection instanceof HttpsURLConnection && sslOptions != null) {\n      HttpsURLConnection httpsConnection = (HttpsURLConnection) connection;\n      try {\n        SSLContext sslContext = sslOptions.createSslContext();\n        httpsConnection.setSSLSocketFactory(sslContext.getSocketFactory());\n\n        if (sslOptions.getSslVerifyMode() == SslVerifyMode.CA\n            || sslOptions.getSslVerifyMode() == SslVerifyMode.INSECURE) {\n          httpsConnection.setHostnameVerifier((h, s) -> true); // skip hostname check\n        }\n      } catch (GeneralSecurityException e) {\n        throw new IOException(\"SSL configuration failed\", e);\n      }\n    }\n\n    connection.setRequestMethod(method);\n    connection.setConnectTimeout(timeoutMs);\n    connection.setReadTimeout(timeoutMs);\n    connection.setRequestProperty(\"Authorization\", getAuthenticationHeader(credentials));\n\n    return connection;\n  }\n\n  // This is just to avoid putting password chars directly into a string\n  private static String getAuthenticationHeader(RedisCredentials credentials) throws IOException {\n    // Build Basic auth without creating a password String\n    final char[] pass = credentials.getPassword() != null ? credentials.getPassword() : new char[0];\n    final String user = credentials.getUser() != null ? credentials.getUser() : \"\";\n    final byte[] userBytes = user.getBytes(StandardCharsets.UTF_8);\n","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/redis/jedis/blob/6dac31d4c224fb3257c216f3985340c6f500cdcb/src/main/java/redis/clients/jedis/mcf/RedisRestAPI.java#L124-L160","documentation":"createConnection() configures TLS for HTTPS calls to the Redis Enterprise REST API. If building the SSLContext/TrustManager/HostnameVerifier setup throws GeneralSecurityException, it is wrapped in IOException(\"SSL configuration failed\"). This is a client-side SSL setup problem, not a handshake failure.","triggerScenarios":"Invalid keystore/truststore paths or formats, unsupported TLS algorithm names in the JVM, corrupted certificates supplied via SslOptions, or a JVM lacking the requested crypto provider.","commonSituations":"Misspelled truststore path or password; PKCS12 vs JKS confusion; custom SslOptions built with a bad KeyManagerFactory; restricted JCE policies on old JVMs.","solutions":["Validate SslOptions: check keystore/truststore paths, passwords, and that the files load before calling the API","Inspect the wrapped GeneralSecurityException cause for the exact crypto error","Re-export the certificate in a standard format (PKCS12) and rebuild SslOptions","Test SSL setup in isolation (load KeyStore/SSLContext directly) before configuring the client"],"exampleFix":"// before\nSslOptions opts = SslOptions.builder().truststore(\"/path/typo.jks\", \"pass\").build();\n// after\nSslOptions opts = SslOptions.builder()\n    .truststore(\"/path/truststore.p12\", \"correctPassword\")\n    .trustStoreType(\"PKCS12\")\n    .build();","handlingStrategy":"validation","validationCode":"try { KeyStore ks = KeyStore.getInstance(\"PKCS12\"); ks.load(new FileInputStream(truststorePath), password); } catch (Exception e) { /* fail fast: bad SslOptions */ }","typeGuard":"boolean validSslOptions(SslOptions o) { return o != null && o.getSslVerifyMode() != null; } // plus load keystores eagerly at startup","tryCatchPattern":"try { api.bdbs(); } catch (IOException e) { if (e.getCause() instanceof GeneralSecurityException) { /* fix SslOptions */ } }","preventionTips":["Load and validate keystores/truststores at startup, not lazily","Use standard formats (PKCS12) and verify passwords","Log the GeneralSecurityException cause chain when configuring SSL"],"tags":["ssl","tls","configuration","rest-api"],"backgroundTag":"ssl-configuration-failed","analyzedSha":"6dac31d4c224fb3257c216f3985340c6f500cdcb","analyzedAt":"2026-09-08T04:55:01.204Z","contentChangedAt":"2026-09-08T04:55:01.204Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}