elastic/elasticsearch · error · UserException

74

74

Error message

Error creating the elasticsearch keystore.

What it means

Thrown by CreateKeyStoreCommand when `KeyStoreWrapper.create()` + `save(...)` raises a `SecurityException`. Exits IO_ERROR (74). Because create is the bootstrap path, this SecurityException usually reflects a JVM/JCE problem (provider misconfiguration, missing algorithm) rather than a wrong password — there is no prior keystore to decrypt. The command had already prompted to overwrite if the file exists.

Source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/CreateKeyStoreCommand.java:54

        super("Creates a new elasticsearch keystore");
        this.passwordOption = parser.acceptsAll(Arrays.asList("p", "password"), "Prompt for password to encrypt the keystore");
    }

    @Override
    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
        try (SecureString password = options.has(passwordOption) ? readPassword(terminal, true) : new SecureString(new char[0])) {
            Path keystoreFile = KeyStoreWrapper.keystorePath(env.configDir());
            if (Files.exists(keystoreFile)) {
                if (terminal.promptYesNo("An elasticsearch keystore already exists. Overwrite?", false) == false) {
                    terminal.println("Exiting without creating keystore.");
                    return;
                }
            }
            KeyStoreWrapper keystore = KeyStoreWrapper.create();
            keystore.save(env.configDir(), password.getChars());
            terminal.println("Created elasticsearch keystore in " + KeyStoreWrapper.keystorePath(env.configDir()));
        } catch (SecurityException e) {
            throw new UserException(ExitCodes.IO_ERROR, "Error creating the elasticsearch keystore.");
        }
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Check the config directory is writable by the user running the CLI: `touch $ES_PATH_CONF/.write-test`.
2. Inspect the JVM's security providers / FIPS configuration; ensure BouncyCastle or the default SunJCE provider is available.
3. Disable or adjust SELinux/AppArmor/capabilities so the process can write `elasticsearch.keystore`.
4. Look at the full stack trace of the SecurityException to identify the failing operation.

Path dir = env.configDir();
if (!Files.isWritable(dir)) {
    throw new IllegalStateException("Config dir not writable: " + dir);
}

try {
    createKeystore();
} catch (UserException e) {
    if (e.exitCode == ExitCodes.IO_ERROR) {
        // inspect underlying SecurityException cause; check providers + permissions
    }
}

When it happens

Trigger: Running `create` on a JVM whose security policy or provider list disallows the keystore algorithms; a read-only config directory that prevents writing the new file in a way surfaced as SecurityException; custom security manager blocking the write.

Common situations: Hardened/FIPS JVM without the required provider registered; Docker/SELinux denying writes to the config dir; running as a user without write permission on `ES_PATH_CONF`.

Related errors

• 74
• 65
• 74
• 64
• 64

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/64fd406ddb89dffc. Report an issue: GitHub.