elastic/elasticsearch · error · SslConfigException

failed to find a X509ExtendedKeyManager in the key manager f

Error message

failed to find a X509ExtendedKeyManager in the key manager factory for [{}] and keystore [{}]

What it means

Thrown by KeyStoreUtil.createKeyManager() when KeyManagerFactory.getKeyManagers() returns an array containing no instance of X509ExtendedKeyManager. The factory initialised successfully but produced only non-X509 managers (or an empty array), so the SSL stack has no usable key manager.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java:161

        throws GeneralSecurityException, IOException {
        KeyStore keyStore = buildKeyStore(List.of(certificateChain), privateKey, password);
        return createKeyManager(keyStore, password, KeyManagerFactory.getDefaultAlgorithm());
    }

    /**
     * Creates a {@link X509ExtendedKeyManager} based on the key material in the provided {@link KeyStore}
     */
    public static X509ExtendedKeyManager createKeyManager(KeyStore keyStore, char[] password, String algorithm)
        throws GeneralSecurityException {
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);
        kmf.init(keyStore, password);
        KeyManager[] keyManagers = kmf.getKeyManagers();
        for (KeyManager keyManager : keyManagers) {
            if (keyManager instanceof X509ExtendedKeyManager x509ExtendedKeyManager) {
                return x509ExtendedKeyManager;
            }
        }
        throw new SslConfigException(
            "failed to find a X509ExtendedKeyManager in the key manager factory for [" + algorithm + "] and keystore [" + keyStore + "]"
        );
    }

    /**
     * Creates a {@link X509ExtendedTrustManager} based on the trust material in the provided {@link KeyStore}
     */
    public static X509ExtendedTrustManager createTrustManager(@Nullable KeyStore trustStore, String algorithm)
        throws NoSuchAlgorithmException, KeyStoreException {
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
        tmf.init(trustStore);
        TrustManager[] trustManagers = tmf.getTrustManagers();
        for (TrustManager trustManager : trustManagers) {
            if (trustManager instanceof X509ExtendedTrustManager x509ExtendedTrustManager) {
                return x509ExtendedTrustManager;
            }
        }
        throw new SslConfigException(

View on GitHub (pinned to db6a809a66)

Solutions

1. Use the default algorithm: leave the keystore.algorithm setting unset, or set it to KeyManagerFactory.getDefaultAlgorithm() (typically SunX509).
2. Verify the keystore opens with the configured password and contains a key entry (`keytool -list -v -keystore ks.p12`).
3. If using a PKCS#11/HSM provider, consult its docs to ensure it ships an X509ExtendedKeyManager.
4. Check provider order in `java.security`; move SunJSSE ahead of third-party providers if needed.

Example fix

// before: non-default algorithm produces non-X509 manager
X509ExtendedKeyManager km = KeyStoreUtil.createKeyManager(ks, pwd, "PKIX");

// after: default SunX509 (always returns X509ExtendedKeyManager on stock JVM)
X509ExtendedKeyManager km = KeyStoreUtil.createKeyManager(
    ks, pwd, KeyManagerFactory.getDefaultAlgorithm());

// Confirm the algorithm produces X509ExtendedKeyManagers before relying on it.
public static boolean algorithmReturnsX509Km(String algorithm, KeyStore ks, char[] pwd) throws Exception {
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);
    kmf.init(ks, pwd);
    for (KeyManager km : kmf.getKeyManagers()) {
        if (km instanceof X509ExtendedKeyManager) return true;
    }
    return false;
}

When it happens

Trigger: createKeyManager(keyStore, password, algorithm): after kmf.init(...) and iterating keyManagers, no element is an X509ExtendedKeyManager. Common with a non-default algorithm (e.g. PKIX on a provider that returns plain X509KeyManager), an empty or corrupt keystore that causes the factory to return nothing, or a third-party JCE provider.

Common situations: Configuring xpack.security.transport.ssl.keystore.algorithm to a non-standard value; using a HSM/PKCS#11 provider whose KeyManagerFactory returns provider-specific types; keystore loaded with the wrong password so no key entries are visible; provider ordering (e.g. BouncyCastle installed as first provider).

Related errors

• Unexpected error initializing a new in-memory keystore
• failed to find a X509ExtendedTrustManager in the trust manag
• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length missing

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/a7ed820f3d6360cf. Report an issue: GitHub.