elastic/elasticsearch · error · UserException

65

65

Error message

{}

What it means

Generic `{}` UserException (DATA_ERROR 65) from ChangeKeyStorePasswordCommand. It catches `SecurityException` thrown while reading the new password pair or while calling `keyStore.save(configDir, newPassword)`. The re-encrypted keystore save can fail with SecurityException if the in-memory keystore state is inconsistent (it was decrypted earlier in BaseKeyStoreCommand), or if the underlying JCE keystore operation rejects the password.

Source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/ChangeKeyStorePasswordCommand.java:37

import org.elasticsearch.env.Environment;

/**
 * A sub-command for the keystore cli which changes the password.
 */
class ChangeKeyStorePasswordCommand extends BaseKeyStoreCommand {

    ChangeKeyStorePasswordCommand() {
        super("Changes the password of a keystore", true);
    }

    @Override
    protected void executeCommand(Terminal terminal, OptionSet options, Environment env) throws Exception {
        try (SecureString newPassword = readPassword(terminal, true)) {
            final KeyStoreWrapper keyStore = getKeyStore();
            keyStore.save(env.configDir(), newPassword.getChars());
            terminal.println("Elasticsearch keystore password changed successfully.");
        } catch (SecurityException e) {
            throw new UserException(ExitCodes.DATA_ERROR, e.getMessage());
        }
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Ensure the current keystore password decrypts successfully first (test with `has-password` then any read command).
2. Re-enter the new password pair carefully, ensuring both prompts match.
3. On JVM crypto errors, verify the security providers and re-run.

try {
    changePassword();
} catch (UserException e) {
    if (e.exitCode == ExitCodes.DATA_ERROR) {
        // verify current password works first via has-password + a read command
    }
}

When it happens

Trigger: Running `change-password` on a keystore whose decryption already failed (so the wrapper SecurityException from BaseKeyStoreCommand propagates a second one); passwords entered at the two prompts that do not match in a way the reader flags; JVM crypto provider issues during re-encryption.

Common situations: Mismatched new-password confirmation; attempting change-password after the keystore password was already forgotten (so the initial decrypt failed); restricted JVM environment.

Related errors

• 64
• 74
• 64
• 65
• 65

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/97e44ca351dba390. Report an issue: GitHub.