elastic/elasticsearch · critical · SslConfigException

failed to initialize a TrustManager for the system keystore

Error message

failed to initialize a TrustManager for the system keystore

What it means

Thrown as SslConfigException by DefaultJdkTrustConfig.createTrustManager when the JVM's default/system trust store cannot be loaded or when TrustManagerFactory.init() fails. DefaultJdkTrustConfig wraps the JDK's built-in CA trust store (typically the cacerts file). The underlying GeneralSecurityException is attached as the cause.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DefaultJdkTrustConfig.java:68

    /**
     * @param trustStorePassword the password for the truststore. It applies only when PKCS#11 tokens are used, is null otherwise
     */
    DefaultJdkTrustConfig(BiFunction<String, String, String> systemProperties, @Nullable char[] trustStorePassword) {
        this.systemProperties = systemProperties;
        this.trustStorePassword = trustStorePassword;
    }

    @Override
    public boolean isSystemDefault() {
        return true;
    }

    @Override
    public X509ExtendedTrustManager createTrustManager() {
        try {
            return KeyStoreUtil.createTrustManager(getSystemTrustStore(), TrustManagerFactory.getDefaultAlgorithm());
        } catch (GeneralSecurityException e) {
            throw new SslConfigException("failed to initialize a TrustManager for the system keystore", e);
        }
    }

    /**
     * When a PKCS#11 token is used as the system default keystore/truststore, we need to pass the keystore
     * password when loading, even for reading certificates only ( as opposed to i.e. JKS keystores where
     * we only need to pass the password for reading Private Key entries ).
     *
     * @return the KeyStore used as truststore for PKCS#11 initialized with the password, null otherwise
     */
    private KeyStore getSystemTrustStore() {
        if (isPkcs11Truststore(systemProperties) && trustStorePassword != null) {
            try {
                KeyStore keyStore = KeyStore.getInstance("PKCS11");
                keyStore.load(null, trustStorePassword);
                return keyStore;
            } catch (GeneralSecurityException | IOException e) {
                throw new SslConfigException("failed to load the system PKCS#11 truststore", e);

View on GitHub (pinned to db6a809a66)

Solutions

1. Check the exception cause: a FileNotFoundException or NoSuchAlgorithmException narrows the problem.
2. Verify the JDK cacerts file exists and is readable: ls -la $JAVA_HOME/lib/security/cacerts.
3. If using a custom javax.net.ssl.trustStore, validate the file path and format with keytool -list -keystore <path>.
4. In containers, ensure the CA certificates package (ca-certificates) is installed or mount a valid cacerts.

Example fix

// before — system property points to a missing truststore
-Djavax.net.ssl.trustStore=/nonexistent/truststore.jks

// after — point to a valid truststore or remove the property to use JDK default
-Djavax.net.ssl.trustStore=/valid/path/cacerts
// or simply omit the property and rely on $JAVA_HOME/lib/security/cacerts

try {
    X509ExtendedTrustManager tm = defaultJdkTrustConfig.createTrustManager();
} catch (SslConfigException e) {
    // check e.getCause() for KeyStoreException / NoSuchAlgorithmException / CertificateException
    log.error("System trust store unavailable: {}", e.getMessage(), e.getCause());
    // verify $JAVA_HOME/lib/security/cacerts exists and is readable
}

When it happens

Trigger: Calling createTrustManager() on a DefaultJdkTrustConfig instance when KeyStoreUtil.createTrustManager(getSystemTrustStore(), TrustManagerFactory.getDefaultAlgorithm()) throws a GeneralSecurityException.

Common situations: The JDK's cacerts file is corrupted, missing, or has restrictive file permissions. A custom javax.net.ssl.trustStore system property points to a non-existent or invalid file. The default TrustManagerFactory algorithm is unavailable (rare, custom security providers). Common when running in a minimal container image that lacks the default CA bundle.

Related errors

• Cannot combine trust configurations [{}]
• failed to load the system PKCS#11 truststore
• Expected ASN.1 object of type 0x{} but was 0x{}
• Invalid DER: stream too short, missing tag
• Failed to initialise TLS context for OTel log export

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/6096a8b49bfe5cd6. Report an issue: GitHub.