elastic/elasticsearch · error · UserException

65

65

Error message

Elasticsearch keystore not found at [{}]. Use 'create' command to create one.

What it means

Thrown by the BaseKeyStoreCommand shared by all mutating keystore subcommands when `KeyStoreWrapper.load(configDir)` returns null (no keystore file on disk) AND the subcommand was constructed with `keyStoreMustExist=true`. This applies to list/add/remove/show/change-password but not create. Exits DATA_ERROR (65). It tells the operator to run `create` first.

Source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/BaseKeyStoreCommand.java:46

    private KeyStoreWrapper keyStore;
    private SecureString keyStorePassword;
    private final boolean keyStoreMustExist;
    OptionSpec<Void> forceOption;

    public BaseKeyStoreCommand(String description, boolean keyStoreMustExist) {
        super(description);
        this.keyStoreMustExist = keyStoreMustExist;
    }

    @Override
    public final void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
        try {
            final Path configFile = env.configDir();
            keyStore = KeyStoreWrapper.load(configFile);
            if (keyStore == null) {
                if (keyStoreMustExist) {
                    throw new UserException(
                        ExitCodes.DATA_ERROR,
                        "Elasticsearch keystore not found at ["
                            + KeyStoreWrapper.keystorePath(env.configDir())
                            + "]. Use 'create' command to create one."
                    );
                } else if (options.has(forceOption) == false) {
                    if (terminal.promptYesNo("The elasticsearch keystore does not exist. Do you want to create it?", false) == false) {
                        terminal.println("Exiting without creating keystore.");
                        return;
                    }
                }
                keyStorePassword = new SecureString(new char[0]);
                keyStore = KeyStoreWrapper.create();
                keyStore.save(configFile, keyStorePassword.getChars());
            } else {
                keyStorePassword = keyStore.hasPassword() ? readPassword(terminal, false) : new SecureString(new char[0]);
                keyStore.decrypt(keyStorePassword.getChars());
            }

View on GitHub (pinned to db6a809a66)

Solutions

1. Run `bin/elasticsearch-keystore create` first to initialize the keystore, then re-run the desired subcommand.
2. Verify `ES_PATH_CONF` points at the intended config directory and that the keystore file is expected there.
3. If migrating, copy the existing `elasticsearch.keystore` into the config dir before issuing mutations.

Example fix

// before
bin/elasticsearch-keystore add-string my.secret
// after
bin/elasticsearch-keystore create && bin/elasticsearch-keystore add-string my.secret

import java.nio.file.Files;
Path ks = KeyStoreWrapper.keystorePath(env.configDir());
if (!Files.exists(ks)) {
    // run 'create' first, or skip the mutating subcommand
}

try {
    runMutatingCommand();
} catch (UserException e) {
    if (e.exitCode == ExitCodes.DATA_ERROR && e.getMessage().contains("keystore not found")) {
        createKeystoreFirst();
        runMutatingCommand();
    } else throw e;
}

When it happens

Trigger: Running `elasticsearch-keystore list` / `add-string` / `remove` / `show` / `change-password` on a fresh node that never had a keystore created; pointing `ES_PATH_CONF` at a config dir without `elasticsearch.keystore`; the keystore file was deleted.

Common situations: New cluster bootstrap where someone jumped to adding settings before running `create`; misconfigured `ES_PATH_CONF` pointing at a stale or wrong directory; container image that does not ship a keystore.

Related errors

• 74
• 1
• 64
• 74
• 64

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/ca25c79677b42c66. Report an issue: GitHub.