elastic/elasticsearch · error · SslConfigException

failed to find a X509ExtendedTrustManager in the trust manag

Error message

failed to find a X509ExtendedTrustManager in the trust manager factory for [{}] and truststore [{}]

What it means

Thrown by KeyStoreUtil.createTrustManager() when TrustManagerFactory.getTrustManagers() returns no X509ExtendedTrustManager. The trust store initialised but the factory did not yield an X.509-capable trust manager, so TLS handshake validation has nothing to use.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/KeyStoreUtil.java:179

        throw new SslConfigException(
            "failed to find a X509ExtendedKeyManager in the key manager factory for [" + algorithm + "] and keystore [" + keyStore + "]"
        );
    }

    /**
     * Creates a {@link X509ExtendedTrustManager} based on the trust material in the provided {@link KeyStore}
     */
    public static X509ExtendedTrustManager createTrustManager(@Nullable KeyStore trustStore, String algorithm)
        throws NoSuchAlgorithmException, KeyStoreException {
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
        tmf.init(trustStore);
        TrustManager[] trustManagers = tmf.getTrustManagers();
        for (TrustManager trustManager : trustManagers) {
            if (trustManager instanceof X509ExtendedTrustManager x509ExtendedTrustManager) {
                return x509ExtendedTrustManager;
            }
        }
        throw new SslConfigException(
            "failed to find a X509ExtendedTrustManager in the trust manager factory for ["
                + algorithm
                + "] and truststore ["
                + trustStore
                + "]"
        );
    }

    /**
     * Creates a {@link X509ExtendedTrustManager} based on the provided certificates
     *
     * @param certificates the certificates to trust
     * @return a trust manager that trusts the provided certificates
     */
    public static X509ExtendedTrustManager createTrustManager(Collection<Certificate> certificates) throws GeneralSecurityException {
        KeyStore store = buildTrustStore(certificates);
        return createTrustManager(store, TrustManagerFactory.getDefaultAlgorithm());
    }

View on GitHub (pinned to db6a809a66)

Solutions

1. Leave the algorithm at its default (TrustManagerFactory.getDefaultAlgorithm(), usually PKIX).
2. If using a FIPS provider, follow Elastic FIPS docs to configure the truststore algorithm and provider.
3. Ensure the truststore is non-null and contains at least one certificate (`keytool -list -keystore ts.p12`).
4. Reorder providers in `java.security` so SunJSSE precedes third-party providers.

Example fix

// before: custom algorithm yields non-X509 trust manager
X509ExtendedTrustManager tm = KeyStoreUtil.createTrustManager(ts, "X509");

// after: default algorithm
X509ExtendedTrustManager tm = KeyStoreUtil.createTrustManager(
    ts, TrustManagerFactory.getDefaultAlgorithm());

public static boolean algorithmReturnsX509Tm(String algorithm, KeyStore ts) throws Exception {
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
    tmf.init(ts);
    for (TrustManager tm : tmf.getTrustManagers()) {
        if (tm instanceof X509ExtendedTrustManager) return true;
    }
    return false;
}

When it happens

Trigger: createTrustManager(trustStore, algorithm): after tmf.init(trustStore) and iterating, none of trustManagers is an X509ExtendedTrustManager. Happens with non-default algorithms, third-party providers, or when trustStore is null on a JVM/provider that returns an empty manager array.

Common situations: xpack.security.transport.ssl.truststore.algorithm set to a custom value; BCFIPS or other FIPS provider whose TrustManagerFactory returns provider-specific types; null trust store passed to a provider that does not synthesise a default X.509 trust manager; misconfigured provider order.

Related errors

• Unexpected error initializing a new in-memory keystore
• failed to find a X509ExtendedKeyManager in the key manager f
• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length missing

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/d967452fd859781a. Report an issue: GitHub.