elastic/elasticsearch · critical · IllegalStateException

unexpected exception creating MessageDigest instance for [{}

Error message

unexpected exception creating MessageDigest instance for [{}]

What it means

Thrown as IllegalStateException by the FingerprintProcessor.Factory's ThreadLocal initializer when MessageDigest.getInstance(method) cannot find the algorithm on the JVM. The factory has already validated that 'method' is one of SUPPORTED_DIGESTS (MD5, SHA-1, SHA-256, SHA-384, SHA-512), so a NoSuchAlgorithmException here indicates the JVM does not provide one of those algorithms - typically due to a restricted security provider or a stripped/downstream JDK.

Source

Thrown at modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/FingerprintProcessor.java:260

            String method = ConfigurationUtils.readStringProperty(TYPE, processorTag, config, "method", DEFAULT_METHOD);
            if (Arrays.asList(SUPPORTED_DIGESTS).contains(method) == false) {
                throw newConfigurationException(
                    TYPE,
                    processorTag,
                    "method",
                    String.format(
                        Locale.ROOT,
                        "[%s] must be one of the supported hash methods [%s]",
                        method,
                        Strings.arrayToCommaDelimitedString(SUPPORTED_DIGESTS)
                    )
                );
            }
            ThreadLocal<Hasher> threadLocalHasher = ThreadLocal.withInitial(() -> {
                try {
                    return MessageDigestHasher.getInstance(method);
                } catch (NoSuchAlgorithmException e) {
                    throw new IllegalStateException("unexpected exception creating MessageDigest instance for [" + method + "]", e);
                }
            });
            boolean ignoreMissing = readBooleanProperty(TYPE, processorTag, config, "ignore_missing", false);

            return new FingerprintProcessor(processorTag, description, fields, targetField, saltBytes, threadLocalHasher, ignoreMissing);
        }
    }

    // simple interface around MessageDigest to facilitate testing
    public interface Hasher {

        void reset();

        void update(byte[] input);

        byte[] digest();

        String getAlgorithm();

View on GitHub (pinned to db6a809a66)

Solutions

Switch the 'method' to an algorithm that is enabled on the JVM (SHA-256 is the most broadly available in restricted modes).
Inspect java.security and the registered Providers (java.security.Provider) to confirm which algorithms are present; restore the SUN provider or BouncyCastle if removed.
Use a non-restricted JDK distribution for the ingest nodes.
If MD5/SHA-1 are explicitly disabled by policy, do not attempt to use them - they are also cryptographically weak.

Example fix

// before - method disabled by FIPS/restricted policy
{"fingerprint": {"fields": ["id"], "method": "MD5"}}
// after
{"fingerprint": {"fields": ["id"], "method": "SHA-256"}}

Defensive patterns

Strategy: validation

Validate before calling

// Pre-validate the algorithm is available before deploying the pipeline (outside ES):
// java.security.MessageDigest.getInstance("SHA-256");
// On the JVM, list providers:
// java.security.Security.getProviders().each { println it }

Prevention

Prefer SHA-256, which is available on essentially all JDKs including restricted/FIPS modes.
Avoid MD5/SHA-1 - they are disabled on locked-down JVMs and are cryptographically weak.
Audit java.security provider configuration on ingest nodes when running custom distributions.

When it happens

Trigger: Creating/updating a pipeline with a fingerprint processor whose 'method' is valid per SUPPORTED_DIGESTS but unavailable on the running JVM's security providers. This is rare because standard JDKs ship all listed algorithms; it occurs on custom or受限 runtimes.

Common situations: Custom JRE builds that omit MD5/SHA-1 from java.security; FIPS-mode JVMs that disable non-approved algorithms; security policy files removing providers; downstream redistributions on embedded devices.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/83bc42ccf3f3cd10. Report an issue: GitHub.