elastic/elasticsearch · error · SslConfigException

unexpected exception creating MessageDigest instance for [{}

Error message

unexpected exception creating MessageDigest instance for [{}]

What it means

SslUtil.messageDigest requests a MessageDigest instance by algorithm name from the JCE; if no Provider supplies that algorithm, NoSuchAlgorithmException is wrapped in this SslConfigException. Used by calculateFingerprint to compute cert fingerprints for logging/diagnostics.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslUtil.java:34

import java.util.Objects;

public final class SslUtil {

    private SslUtil() {
        // utility class
    }

    public static String calculateFingerprint(X509Certificate certificate, String algorithm) throws CertificateEncodingException {
        final MessageDigest sha1 = messageDigest(algorithm);
        sha1.update(certificate.getEncoded());
        return toHexString(sha1.digest());
    }

    static MessageDigest messageDigest(String digestAlgorithm) {
        try {
            return MessageDigest.getInstance(digestAlgorithm);
        } catch (NoSuchAlgorithmException e) {
            throw new SslConfigException("unexpected exception creating MessageDigest instance for [" + digestAlgorithm + "]", e);
        }
    }

    private static final char[] HEX_DIGITS = "0123456789abcdef".toCharArray();

    /**
     * Format a byte array as a hex string.
     *
     * @param bytes the input to be represented as hex.
     * @return a hex representation of the input as a String.
     */
    static String toHexString(byte[] bytes) {
        return new String(toHexCharArray(bytes));
    }

    /**
     * Encodes the byte array into a newly created hex char array, without allocating any other temporary variables.
     *

View on GitHub (pinned to db6a809a66)

Solutions

1. Use the standard JCE algorithm names: "SHA-1", "SHA-256", "SHA-384", "SHA-512" (note the hyphen).
2. List algorithms available on your JVM: Security.getAlgorithms("MessageDigest").
3. If you need a non-default algorithm, install the provider (e.g. BouncyCastle) and confirm it is registered.

Example fix

// before
SslUtil.calculateFingerprint(cert, "SHA256");
// after
SslUtil.calculateFingerprint(cert, "SHA-256");

private static final Set<String> KNOWN_DIGESTS =
    java.security.Security.getAlgorithms("MessageDigest");
String ensureDigest(String alg) {
    if (!KNOWN_DIGESTS.contains(alg))
        throw new IllegalArgumentException("Unknown MessageDigest algorithm: " + alg + "; available: " + KNOWN_DIGESTS);
    return alg;
}

try {
    String fp = SslUtil.calculateFingerprint(cert, alg);
} catch (SslConfigException e) {
    if (e.getCause() instanceof NoSuchAlgorithmException)
        throw new IllegalArgumentException("Unsupported digest algorithm: " + alg, e);
    throw e;
}

When it happens

Trigger: calculateFingerprint is invoked with an algorithm name that MessageDigest.getInstance does not recognise — e.g. "SHA256" instead of "SHA-256", "sha-3-256", or a provider-specific name on a JVM that lacks the provider.

Common situations: Caller passes a non-standard digest name; BouncyCastle-specific algorithm used on a stock JDK; uppercase/spacing typo; FIPS-restricted JVM that disables MD5/SHA1.

Related errors

• Error parsing EC named curve identifier. Named curve with OI
• failed to load a KeyManager for certificate/key pair [{}], [
• could not load ssl private key file [{}]
• cannot create trust using PEM certificates [{}]
• Error parsing Private Key [{}], file is empty

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/c6f14e80462c201a. Report an issue: GitHub.