elastic/elasticsearch · error · ElasticsearchException

Exception while reloading enterprise geoip download task exe

Error message

Exception while reloading enterprise geoip download task executor

What it means

Thrown by EnterpriseGeoIpDownloaderTaskExecutor.reload when cloning the secure settings for MAXMIND_LICENSE_KEY_SETTING and IPINFO_TOKEN_SETTING fails. InMemoryClonedSecureSettings.cloneSecureSettings performs crypto operations that can raise GeneralSecurityException; it is rethrown as an ElasticsearchException so the ReloadablePlugin machinery above can log and handle it. This blocks the downloader from picking up new credentials on settings reload.

Source

Thrown at modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/EnterpriseGeoIpDownloaderTaskExecutor.java:183

                && event.changedCustomProjectMetadataSet().contains(IngestGeoIpMetadata.TYPE);
            if (hasGeoIpMetadataChanges) {
                // watching the cluster changed events to kick the thing off if it's not running
                currentDownloader.requestRunOnDemand();
            }
        }
    }

    public synchronized void reload(Settings settings) {
        // `SecureSettings` are available here! cache them as they will be needed
        // whenever dynamic cluster settings change and we have to rebuild the accounts
        try {
            this.cachedSecureSettings = InMemoryClonedSecureSettings.cloneSecureSettings(
                settings,
                List.of(MAXMIND_LICENSE_KEY_SETTING, IPINFO_TOKEN_SETTING)
            );
        } catch (GeneralSecurityException e) {
            // rethrow as a runtime exception, there's logging higher up the call chain around ReloadablePlugin
            throw new ElasticsearchException("Exception while reloading enterprise geoip download task executor", e);
        }
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

Check the surrounding ReloadablePlugin log lines for the wrapped GeneralSecurityException cause (decrypt failure, algorithm not available, etc.).
Recreate the affected secure setting (elasticsearch-keystore remove + add for the maxmind/ipinfo keys).
Ensure the same security providers are available as when the keystore was created (no FIPS/non-FIPS flip, same JDK vendor).
Restart the node after keystore repair.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    executor.reload(settings);
} catch (ElasticsearchException e) {
    if (e.getMessage().startsWith("Exception while reloading")) {
        // inspect e.getCause() (GeneralSecurityException); recreate keystore entries, ensure security providers, restart
    } else throw e;
}

Prevention

Do not switch JDK security provider posture (FIPS/non-FIPS) without recreating the keystore.
Back up elasticsearch.keystore before upgrades.
Recreate maxmind/ipinfo secure settings after any keystore migration.
Watch ReloadablePlugin log lines around reload() for the wrapped cause.

When it happens

Trigger: Plugin reload (settings change, or node restart re-reading the keystore) calls reload(settings) -> cloneSecureSettings throws GeneralSecurityException -> wrapped and rethrown.

Common situations: Corrupted or partially-restored elasticsearch.keystore; JVM security provider mismatch (FIPS mode, missing BouncyCastle); keystore encrypted with an algorithm the runtime cannot decrypt; secure settings version skew after an upgrade.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/d8b1cedd7da5cfcc. Report an issue: GitHub.