elastic/elasticsearch · error · SslConfigException

cannot create trust using PEM certificates [{}]

Error message

cannot create trust using PEM certificates [{}]

What it means

Thrown by PemTrustConfig.createTrustManager() to wrap any GeneralSecurityException raised while building a TrustManager from a list of PEM certificate-authority files. The exception lists every CA path that was resolved, so the operator can find the offending file.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemTrustConfig.java:84

        for (String caPath : certificateAuthorities) {
            for (Certificate cert : readCertificates(List.of(resolveFile(caPath)))) {
                if (cert instanceof X509Certificate) {
                    info.add(new StoredCertificate((X509Certificate) cert, caPath, "PEM", null, false));
                }
            }
        }
        return info;
    }

    @Override
    public X509ExtendedTrustManager createTrustManager() {
        final List<Path> paths = resolveFiles();
        try {
            final List<Certificate> certificates = readCertificates(paths);
            final KeyStore store = KeyStoreUtil.buildTrustStore(certificates);
            return KeyStoreUtil.createTrustManager(store, TrustManagerFactory.getDefaultAlgorithm());
        } catch (GeneralSecurityException e) {
            throw new SslConfigException("cannot create trust using PEM certificates [" + SslFileUtil.pathsToString(paths) + "]", e);
        }
    }

    private List<Path> resolveFiles() {
        return this.certificateAuthorities.stream().map(this::resolveFile).toList();
    }

    private Path resolveFile(String other) {
        return basePath.resolve(other);
    }

    private List<Certificate> readCertificates(List<Path> paths) {
        try {
            return PemUtils.readCertificates(paths);
        } catch (SecurityException e) {
            throw SslFileUtil.accessControlFailure(CA_FILE_TYPE, paths, e, basePath);
        } catch (IOException e) {
            throw SslFileUtil.ioException(CA_FILE_TYPE, paths, e, null, basePath);

View on GitHub (pinned to db6a809a66)

Solutions

1. Validate each CA file individually: `openssl x509 -in ca.pem -noout -text` (should print certificate details).
2. Inspect the wrapped cause (SslConfigException.getCause()) to identify which file/class of failure.
3. Ensure each file contains at least one `-----BEGIN CERTIFICATE-----` block.
4. If a bundle has intermediate + root, split or keep them concatenated — both are supported; just ensure no malformed blocks.

Example fix

# before: trust path points at a CSR by mistake
# elasticsearch.yml: xpack.security.transport.ssl.certificate_authorities: ["server.csr"]

# after: use the real CA cert
openssl x509 -in ca.pem -noout -subject  # sanity check
# configure certificate_authorities: ["ca.pem"]

// Validate that every CA file actually contains an X.509 certificate.
public static void validateCaBundle(List<Path> paths) throws Exception {
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    for (Path p : paths) {
        try (InputStream in = Files.newInputStream(p)) {
            if (cf.generateCertificates(in).isEmpty()) {
                throw new IllegalArgumentException("no X.509 certificates in " + p);
            }
        }
    }
}

try {
    return pemTrustConfig.createTrustManager();
} catch (SslConfigException e) {
    log.error("PEM CA bundle failed; inspect each file with `openssl x509 -in <file> -noout -text`: {}", e.getMessage(), e.getCause());
    throw e;
}

When it happens

Trigger: PemTrustConfig.createTrustManager() resolves certificate-authority paths, calls readCertificates(paths), KeyStoreUtil.buildTrustStore(...), then createTrustManager(...). Any GeneralSecurityException (unparseable cert, empty cert file, cert not X.509, unsupported signature algorithm) is wrapped here.

Common situations: CA bundle file contains non-certificate content (e.g. a CSR, a CRL, or a text comment), a PEM file is truncated, a certificate uses a signature algorithm disabled by the JVM (e.g. SHA-1 in restricted mode), or a path points to a directory rather than a file.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to load a KeyManager for certificate/key pair [{}], [
• could not load ssl private key file [{}]
• Error parsing Private Key [{}], file is empty
• cannot read encrypted key [{}] without a password
• could not load ssl private key file [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/8893fa8566d148c6. Report an issue: GitHub.