elastic/elasticsearch · error · SslConfigException

no SSL/TLS protocols have been configured

Error message

no SSL/TLS protocols have been configured

What it means

Defensive guard inside the private contextProtocol(): if supportedProtocols is empty when picking the SSLContext algorithm, no algorithm can be selected. Because the constructor (error 823) already rejects empty protocols and the field is immutable, this branch is effectively unreachable through the public API.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java:149

    public SSLContext createSslContext() {
        final X509ExtendedKeyManager keyManager = keyConfig.createKeyManager();
        final X509ExtendedTrustManager trustManager = trustConfig.createTrustManager();
        try {
            SSLContext sslContext = SSLContext.getInstance(contextProtocol());
            sslContext.init(new X509ExtendedKeyManager[] { keyManager }, new X509ExtendedTrustManager[] { trustManager }, null);
            return sslContext;
        } catch (GeneralSecurityException e) {
            throw new SslConfigException("cannot create ssl context", e);
        }
    }

    /**
     * Picks the best (highest security / most recent standard) SSL/TLS protocol (/version) that is supported by the
     * {@link #supportedProtocols() configured protocols}.
     */
    private String contextProtocol() {
        if (supportedProtocols.isEmpty()) {
            throw new SslConfigException("no SSL/TLS protocols have been configured");
        }
        for (Entry<String, String> entry : ORDERED_PROTOCOL_ALGORITHM_MAP.entrySet()) {
            if (supportedProtocols.contains(entry.getKey())) {
                return entry.getValue();
            }
        }
        throw new SslConfigException(
            "no supported SSL/TLS protocol was found in the configured supported protocols: " + supportedProtocols
        );
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Treat this as a programmer error — ensure the SslConfiguration constructor always receives a non-empty protocols list.
2. If seen in production, audit for reflective access or serialization paths that reconstruct the object without the constructor.
3. Report as a bug if reached via documented APIs.

// Ensure the constructor invariant holds; this internal branch should be unreachable.
Objects.requireNonNull(protocols, "protocols");
if (protocols.isEmpty()) throw new IllegalStateException("protocols must not be empty before SslConfiguration is built");

When it happens

Trigger: Only reachable via reflection or a future code change that bypasses the constructor's empty-list check. In normal flows the constructor precondition fires first.

Common situations: Subclassing SslConfiguration in a non-standard way; a future refactor that adds a setter; tests using reflection to clear the field.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• cannot configure SSL/TLS without any supported protocols
• no supported SSL/TLS protocol was found in the configured su
• no protocols configured in [{}]
• security exception
• Can not use {} with {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/f8356dd8608ecd49. Report an issue: GitHub.