What causes "could not create the default ssl context" in elastic/elasticsearch?

Run on a standard JDK distribution where SunJSSE is present.

elastic/elasticsearch · critical · IllegalStateException

could not create the default ssl context

Error message

could not create the default ssl context

What it means

Thrown when the default SSLContext cannot be obtained during HttpClient creation: SSLContext.getDefault() raised NoSuchAlgorithmException, meaning the JVM has no usable TLS provider. The original exception is chained. The client cannot initialise secure connections, so startup fails.

Source

Thrown at client/rest/src/main/java/org/elasticsearch/client/RestClientBuilder.java:340

        }

        try {
            HttpAsyncClientBuilder httpClientBuilder = HttpAsyncClientBuilder.create()
                .setDefaultRequestConfig(requestConfigBuilder.build())
                // default settings for connection pooling may be too constraining
                .setMaxConnPerRoute(DEFAULT_MAX_CONN_PER_ROUTE)
                .setMaxConnTotal(DEFAULT_MAX_CONN_TOTAL)
                .setSSLContext(SSLContext.getDefault())
                .setUserAgent(USER_AGENT_HEADER_VALUE)
                .setTargetAuthenticationStrategy(new PersistentCredentialsAuthenticationStrategy())
                .setThreadFactory(new RestClientThreadFactory());
            if (httpClientConfigCallback != null) {
                httpClientBuilder = httpClientConfigCallback.customizeHttpClient(httpClientBuilder);
            }

            return httpClientBuilder.build();
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("could not create the default ssl context", e);
        }
    }

    /**
     * Callback used the default {@link RequestConfig} being set to the {@link CloseableHttpClient}
     * @see HttpClientBuilder#setDefaultRequestConfig
     */
    public interface RequestConfigCallback {
        /**
         * Allows to customize the {@link RequestConfig} that will be used with each request.
         * It is common to customize the different timeout values through this method without losing any other useful default
         * value that the {@link RestClientBuilder} internally sets.
         */
        RequestConfig.Builder customizeRequestConfig(RequestConfig.Builder requestConfigBuilder);
    }

    /**
     * Callback used to customize the {@link CloseableHttpClient} instance used by a {@link RestClient} instance.

View on GitHub (pinned to db6a809a66)

Solutions

Run on a standard JDK distribution where SunJSSE is present.
Inspect $JAVA_HOME/conf/security/java.security for removed/disabled TLS providers and restore them.
If a custom SSLContext is required, supply it via httpClientBuilder callback (setSSLContext) instead of relying on the default.
Verify with: keytool -list or a trivial SSLContext.getInstance("TLS") test.

Example fix

// before
RestClient.builder(new HttpHost("https", "es", 9200)).build(); // default SSLContext fails
// after
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, null, null);
RestClient.builder(new HttpHost("https", "es", 9200))
    .setHttpClientConfigCallback(b -> b.setSSLContext(ctx))
    .build();

Defensive patterns

Strategy: fallback

Validate before calling

SSLContext ctx;
try { ctx = SSLContext.getDefault(); }
catch (NoSuchAlgorithmException e) { ctx = SSLContext.getInstance("TLS"); ctx.init(null, null, null); }

Try / catch

try { RestClient.builder(httpsHost).build(); }
catch (IllegalStateException e) {
    if (e.getMessage().equals("could not create the default ssl context")) {
        // supply explicit SSLContext via httpClientConfigCallback and retry
    } else throw e;
}

Prevention

Pin a supported JDK image with SunJSSE in your container/Dockerfile.
Provide an explicit SSLContext via the httpClientBuilder callback in production.

When it happens

Trigger: Building a RestClient for https endpoints on a JVM where the default TLS algorithm is unavailable or disabled via java.security properties.

Common situations: Custom JRE / minimal runtime with SSL providers removed; overly restrictive java.security (ssl.SocketFactory.provider removed); broken JDK install; running on a stripped container image.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/7642d835500493d5. Report an issue: GitHub.