elastic/elasticsearch · error · UserException

65

65

Error message

{}

What it means

Generic `{}` UserException (DATA_ERROR 65) from ChangeKeyStorePasswordCommand. It catches `SecurityException` thrown while reading the new password pair or while calling `keyStore.save(configDir, newPassword)`. The re-encrypted keystore save can fail with SecurityException if the in-memory keystore state is inconsistent (it was decrypted earlier in BaseKeyStoreCommand), or if the underlying JCE keystore operation rejects the password.

Solutions

1. Ensure the current keystore password decrypts successfully first (test with `has-password` then any read command).
2. Re-enter the new password pair carefully, ensuring both prompts match.
3. On JVM crypto errors, verify the security providers and re-run.

try {
    changePassword();
} catch (UserException e) {
    if (e.exitCode == ExitCodes.DATA_ERROR) {
        // verify current password works first via has-password + a read command
    }
}

When it happens

Trigger: Running `change-password` on a keystore whose decryption already failed (so the wrapper SecurityException from BaseKeyStoreCommand propagates a second one); passwords entered at the two prompts that do not match in a way the reader flags; JVM crypto provider issues during re-encryption.

Common situations: Mismatched new-password confirmation; attempting change-password after the keystore password was already forgotten (so the initial decrypt failed); restricted JVM environment.

Related errors

• 1
• 64
• 64
• 64
• 64

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/97e44ca351dba390. Report an issue: GitHub.

Appendix: source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/ChangeKeyStorePasswordCommand.java:37

import org.elasticsearch.env.Environment;

/**
 * A sub-command for the keystore cli which changes the password.
 */
class ChangeKeyStorePasswordCommand extends BaseKeyStoreCommand {

    ChangeKeyStorePasswordCommand() {
        super("Changes the password of a keystore", true);
    }

    @Override
    protected void executeCommand(Terminal terminal, OptionSet options, Environment env) throws Exception {
        try (SecureString newPassword = readPassword(terminal, true)) {
            final KeyStoreWrapper keyStore = getKeyStore();
            keyStore.save(env.configDir(), newPassword.getChars());
            terminal.println("Elasticsearch keystore password changed successfully.");
        } catch (SecurityException e) {
            throw new UserException(ExitCodes.DATA_ERROR, e.getMessage());
        }
    }
}

View on GitHub (pinned to db6a809a66)