elastic/elasticsearch · error · SslConfigException

the truststore [${path}] does not contain any trusted certif

Error message

the truststore [${path}] does not contain any trusted certificate entries

What it means

checkTrustStore walks every alias of a truststore and returns as soon as it finds a trustedCertificateEntry. If no alias is a certificate entry (e.g. the store holds only PrivateKey entries or is empty), it throws an SslConfigException naming the path. A truststore must contain at least one CA certificate to verify peer chains against.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/StoreTrustConfig.java:134

        return extra;
    }

    private String fileTypeForException() {
        return "[" + type + "] keystore (as a truststore)";
    }

    /**
     * Verifies that the keystore contains at least 1 trusted certificate entry.
     */
    private static void checkTrustStore(KeyStore store, Path path) throws GeneralSecurityException {
        Enumeration<String> aliases = store.aliases();
        while (aliases.hasMoreElements()) {
            String alias = aliases.nextElement();
            if (store.isCertificateEntry(alias)) {
                return;
            }
        }
        throw new SslConfigException("the truststore [" + path + "] does not contain any trusted certificate entries");
    }

    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (o == null || getClass() != o.getClass()) return false;
        StoreTrustConfig that = (StoreTrustConfig) o;
        return truststorePath.equals(that.truststorePath)
            && Arrays.equals(password, that.password)
            && type.equals(that.type)
            && algorithm.equals(that.algorithm);
    }

    @Override
    public int hashCode() {
        int result = Objects.hash(truststorePath, type, algorithm);
        result = 31 * result + Arrays.hashCode(password);
        return result;

View on GitHub (pinned to db6a809a66)

Solutions

1. Import the issuing CA certificate: keytool -importcert -alias ca -file ca.pem -keystore truststore.jks -storetype jks
2. Verify the result: keytool -list -keystore truststore.jks should list at least one trustedCertEntry
3. Swap the file references if truststore.path and keystore.path are inverted
4. Re-export the CA from the server certificate and re-import it

Example fix

// before: truststore has only a key entry
keytool -list -keystore trust.jks  # => PrivateKeyEntry
// after: import the CA as a trusted cert
keytool -importcert -alias root-ca -file ca.pem -keystore trust.jks

KeyStore ks = KeyStore.getInstance(type);
try (InputStream in = Files.newInputStream(path)) { ks.load(in, password); }
boolean hasCert = Collections.list(ks.aliases()).stream().anyMatch(ks::isCertificateEntry);
if (!hasCert) throw new IllegalStateException("truststore has no trusted cert: " + path);

static boolean truststoreHasCertEntry(KeyStore ks) throws KeyStoreException {
    return Collections.list(ks.aliases()).stream().anyMatch(ks::isCertificateEntry);
}

try {
    new StoreTrustConfig(...);
} catch (SslConfigException e) {
    // import the CA before retrying
    throw e;
}

When it happens

Trigger: Loading a keystore via StoreTrustConfig where store.isCertificateEntry(alias) is false for every alias. Typical when a file containing only your own private key (or only key entries) is referenced as truststore.path.

Common situations: Swapped keystore and truststore file paths in config; imported the server key but never imported the signing CA; truststore file was generated empty or overwritten; pointing truststore.path at a PKCS#12 that only has a key entry.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• could not resolve ssl client verification mode, unknown valu
• the ${keystoreType} keystore [${path}]does not contain a pri
• CONFIG
• cannot create trust using PEM certificates [{}]
• cannot specify both [{}] and [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/2e38a1f0cebfbe7e. Report an issue: GitHub.