What causes "cannot create ssl context" in elastic/elasticsearch?

Inspect the attached cause — it names the real failure (UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException, etc.).

elastic/elasticsearch · critical · SslConfigException

cannot create ssl context

Error message

cannot create ssl context

What it means

createSslContext wraps any GeneralSecurityException thrown while obtaining the SSLContext instance or calling SSLContext.init. The underlying cause is attached — typically a bad key, bad trust material, or unsupported protocol/algorithm combination. This is the umbrella exception for keystore/truststore/PEM problems at context-build time.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java:139

        certificates.addAll(trustConfig.getConfiguredCertificates());
        return certificates;
    }

    /**
     * Dynamically create a new SSL context based on the current state of the configuration.
     * Because the {@link #keyConfig() key config} and {@link #trustConfig() trust config} may change based on the
     * contents of their referenced files (see {@link #getDependentFiles()}, consecutive calls to this method may
     * return ssl-contexts with different configurations.
     */
    public SSLContext createSslContext() {
        final X509ExtendedKeyManager keyManager = keyConfig.createKeyManager();
        final X509ExtendedTrustManager trustManager = trustConfig.createTrustManager();
        try {
            SSLContext sslContext = SSLContext.getInstance(contextProtocol());
            sslContext.init(new X509ExtendedKeyManager[] { keyManager }, new X509ExtendedTrustManager[] { trustManager }, null);
            return sslContext;
        } catch (GeneralSecurityException e) {
            throw new SslConfigException("cannot create ssl context", e);
        }
    }

    /**
     * Picks the best (highest security / most recent standard) SSL/TLS protocol (/version) that is supported by the
     * {@link #supportedProtocols() configured protocols}.
     */
    private String contextProtocol() {
        if (supportedProtocols.isEmpty()) {
            throw new SslConfigException("no SSL/TLS protocols have been configured");
        }
        for (Entry<String, String> entry : ORDERED_PROTOCOL_ALGORITHM_MAP.entrySet()) {
            if (supportedProtocols.contains(entry.getKey())) {
                return entry.getValue();
            }
        }
        throw new SslConfigException(
            "no supported SSL/TLS protocol was found in the configured supported protocols: " + supportedProtocols

View on GitHub (pinned to db6a809a66)

Solutions

Inspect the attached cause — it names the real failure (UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException, etc.).
Verify the key password: keytool -list -v -keystore node.p12; for PEM, openssl pkey -in node.key -check -noout.
Confirm key/cert match: compare the modulus of the private key and certificate (openssl rsa/x509 -noout -modulus).
Ensure the JVM supports the chosen protocol/algorithm — list providers with -XshowSettings:security or Security.getProviders().

Example fix

// before: key and certificate do not pair
// ssl.certificate: node.crt   ssl.key: wrong.key
// after: regenerate so key matches cert
//   openssl req -x509 -newkey rsa:2048 -nodes \
//     -keyout node.key -out node.crt -days 730

Defensive patterns

Strategy: try-catch

Try / catch

try {
    SSLContext ctx = sslConfig.createSslContext();
} catch (SslConfigException e) {
    Throwable cause = e.getCause(); // the GeneralSecurityException
    log.error("SSLContext init failed: {}", cause.toString());
    // branch on cause type: UnrecoverableKeyException -> password,
    // NoSuchAlgorithmException -> provider/protocol, etc.
    throw e;
}

Prevention

Validate key/trust files before boot using openssl and keytool in a preflight script.
Keep key and cert paired — generate them together and never edit one independently.
Pin the security provider list and test on the same JVM vendor used in production.

When it happens

Trigger: keyConfig.createKeyManager() or trustConfig.createTrustManager() returned a manager that SSLContext.init rejects; the requested contextProtocol() algorithm is not provided by any Provider; key and trust certs chain mismatch; private key does not match the certificate.

Common situations: Wrong keystore password; PEM key/cert mismatch; certificate signed with a key the JCE cannot handle; FIPS-mode JVM missing a provider; expired or not-yet-valid cert at init time.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/8deac7922cfedb08. Report an issue: GitHub.