elastic/elasticsearch · error · UserException

74

74

Error message

Error creating the elasticsearch keystore.

What it means

Thrown by CreateKeyStoreCommand when `KeyStoreWrapper.create()` + `save(...)` raises a `SecurityException`. Exits IO_ERROR (74). Because create is the bootstrap path, this SecurityException usually reflects a JVM/JCE problem (provider misconfiguration, missing algorithm) rather than a wrong password — there is no prior keystore to decrypt. The command had already prompted to overwrite if the file exists.

Solutions

1. Check the config directory is writable by the user running the CLI: `touch $ES_PATH_CONF/.write-test`.
2. Inspect the JVM's security providers / FIPS configuration; ensure BouncyCastle or the default SunJCE provider is available.
3. Disable or adjust SELinux/AppArmor/capabilities so the process can write `elasticsearch.keystore`.
4. Look at the full stack trace of the SecurityException to identify the failing operation.

Path dir = env.configDir();
if (!Files.isWritable(dir)) {
    throw new IllegalStateException("Config dir not writable: " + dir);
}

try {
    createKeystore();
} catch (UserException e) {
    if (e.exitCode == ExitCodes.IO_ERROR) {
        // inspect underlying SecurityException cause; check providers + permissions
    }
}

When it happens

Trigger: Running `create` on a JVM whose security policy or provider list disallows the keystore algorithms; a read-only config directory that prevents writing the new file in a way surfaced as SecurityException; custom security manager blocking the write.

Common situations: Hardened/FIPS JVM without the required provider registered; Docker/SELinux denying writes to the config dir; running as a user without write permission on `ES_PATH_CONF`.

Related errors

• 65
• 74
• 74
• 1
• 64

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/64fd406ddb89dffc. Report an issue: GitHub.

Appendix: source

Thrown at distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/CreateKeyStoreCommand.java:54

        super("Creates a new elasticsearch keystore");
        this.passwordOption = parser.acceptsAll(Arrays.asList("p", "password"), "Prompt for password to encrypt the keystore");
    }

    @Override
    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {
        try (SecureString password = options.has(passwordOption) ? readPassword(terminal, true) : new SecureString(new char[0])) {
            Path keystoreFile = KeyStoreWrapper.keystorePath(env.configDir());
            if (Files.exists(keystoreFile)) {
                if (terminal.promptYesNo("An elasticsearch keystore already exists. Overwrite?", false) == false) {
                    terminal.println("Exiting without creating keystore.");
                    return;
                }
            }
            KeyStoreWrapper keystore = KeyStoreWrapper.create();
            keystore.save(env.configDir(), password.getChars());
            terminal.println("Created elasticsearch keystore in " + KeyStoreWrapper.keystorePath(env.configDir()));
        } catch (SecurityException e) {
            throw new UserException(ExitCodes.IO_ERROR, "Error creating the elasticsearch keystore.");
        }
    }
}

View on GitHub (pinned to db6a809a66)