elastic/elasticsearch · error · SslConfigException

cannot retrieve setting [{}]

Error message

cannot retrieve setting [{}]

What it means

resolveSetting wraps any checked (non-Runtime) Exception thrown by getSettingAsString while reading a single string value. RuntimeExceptions are rethrown unchanged. The error names the full setting key (prefix + key) and attaches the cause.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java:458

            }
        }
    }

    private String stringSetting(String key) {
        return resolveSetting(key, Function.identity(), null);
    }

    private <V> V resolveSetting(String key, Function<String, V> parser, V defaultValue) {
        try {
            String setting = getSettingAsString(expandSettingKey(key));
            if (setting == null || setting.isEmpty()) {
                return defaultValue;
            }
            return parser.apply(setting);
        } catch (RuntimeException e) {
            throw e;
        } catch (Exception e) {
            throw new SslConfigException("cannot retrieve setting [" + settingPrefix + key + "]", e);
        }
    }

    private char[] resolveSecureSetting(String key, char[] defaultValue) {
        try {
            char[] setting = getSecureSetting(expandSettingKey(key));
            if (setting == null || setting.length == 0) {
                return defaultValue;
            }
            return setting;
        } catch (RuntimeException e) {
            throw e;
        } catch (Exception e) {
            throw new SslConfigException("cannot retrieve secure setting [" + settingPrefix + key + "]", e);
        }

    }

View on GitHub (pinned to db6a809a66)

Solutions

1. Inspect the attached cause for the real failure (IO error, timeout, auth).
2. Make getSettingAsString robust — catch transient failures inside it or declare only RuntimeException-derived types.
3. Verify the underlying settings source is reachable and authorised before reload.

Example fix

// before: subclass throws IOException
public String getSettingAsString(String key) throws IOException {
    return vault.read(key);
}
// after: wrap into a RuntimeException so resolveSetting rethrows cleanly
public String getSettingAsString(String key) {
    try { return vault.read(key); }
    catch (IOException e) { throw new RuntimeException(e); }
}

try {
    SslConfiguration cfg = loader.load(basePath);
} catch (SslConfigException e) {
    if (e.getMessage().startsWith("cannot retrieve setting")) {
        Throwable cause = e.getCause();
        log.error("Settings source failure for {}: {}", e.getMessage(), cause.toString());
    }
    throw e;
}

When it happens

Trigger: A custom SslConfigurationLoader subclass's getSettingAsString implementation throws a checked Exception (e.g. IOException, InterruptedException) for the named setting — for instance when the backing store is a remote secrets manager that fails to respond.

Common situations: Custom Source-of-settings integration (Vault, AWS Secrets Manager) that declares checked exceptions; misbehaving Settings implementation in a plugin; interrupted thread during settings read.

Related errors

• cannot retrieve secure setting [{}]
• failed to load a KeyManager for certificate/key pair [{}], [
• could not load ssl private key file [{}]
• cannot create trust using PEM certificates [{}]
• Error parsing Private Key [{}], file is empty

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/588ee1a65f4a3d09. Report an issue: GitHub.