gradle/gradle · warning

Trust store file {} does not exist or is not readable. This

Error message

Trust store file {} does not exist or is not readable. This may lead to SSL connection failures.

What it means

SystemDefaultSSLContextFactory builds the SSLContext used for HTTPS downloads. When javax.net.ssl.trustStore points at a path that is not an existing readable file (and is not the JSSE default location), the candidate is skipped with this warning and the factory falls back to the next candidate; if no trust store loads, HTTPS downloads fail with SSL handshake errors (e.g. PKIX path building failed).

Source

Thrown at platforms/software/resources-http/src/main/java/org/gradle/internal/resource/transport/http/SystemDefaultSSLContextFactory.java:147

        return getDefaultSecurityPath() + File.separator + "jssecacerts";
    }

    private static TrustManager[] getTrustManagers() throws Exception {
        String storePath = System.getProperty("javax.net.ssl.trustStore", getDefaultJsseTrustStore());
        String storeType = System.getProperty("javax.net.ssl.trustStoreType", KeyStore.getDefaultType());
        String storeProvider = System.getProperty("javax.net.ssl.trustStoreProvider", "");
        String storePasswordString = System.getProperty("javax.net.ssl.trustStorePassword", "");

        KeyStore keyStore = null;
        if (!NONE.equals(storePath)) {
            String[] fileNames = new String[]{storePath, getDefaultTrustStore()};
            for (String fileName : fileNames) {
                File candidate = new File(fileName);
                if (candidate.isFile() && candidate.canRead()) {
                    storePath = fileName;
                    break;
                } else if (!fileName.equals(getDefaultJsseTrustStore())) {
                    LOGGER.warn("Trust store file {} does not exist or is not readable. This may lead to SSL connection failures.", fileName);
                }
            }

            char[] storePassword = null;
            if (!storePasswordString.isEmpty()) {
                storePassword = storePasswordString.toCharArray();
            }

            keyStore = loadKeyStore(
                storePath,
                storeType,
                storeProvider,
                storePassword,
                false
            );
        }

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

View on GitHub (pinned to 534f27719b)

Solutions

1. Point javax.net.ssl.trustStore at an existing, readable absolute path (plus trustStoreType / trustStorePassword as needed)
2. Verify from the same user the daemon runs as: ls -l <path> and test -r <path>
3. Remove the property to use the default JSSE truststore ($JAVA_HOME/lib/security/cacerts)
4. Alternatively import corporate CAs into cacerts with keytool -importcert instead of shipping a custom store

Example fix

# before
systemProp.javax.net.ssl.trustStore=certs/corp-truststore.jks

# after
systemProp.javax.net.ssl.trustStore=/etc/gradle/ssl/corp-truststore.jks
systemProp.javax.net.ssl.trustStoreType=JKS

# before the build, run as the same user as the Gradle daemon
TS=$(grep -oP '^systemProp\.javax\.net\.ssl\.trustStore=\K.*' gradle.properties || true)
[ -z "$TS" ] || { [ -f "$TS" ] && [ -r "$TS" ]; } \
  || { echo "trust store missing or unreadable: $TS"; exit 1; }

When it happens

Trigger: Setting systemProp.javax.net.ssl.trustStore (or -Djavax.net.ssl.trustStore) to a typo'd path, a relative path resolved against a different working directory, a file on an unmounted share, or a file without read permission for the daemon user.

Common situations: Corporate PKI truststores provisioned per machine and missing on CI agents; relative paths that work locally but not from the daemon; permission tightening after security hardening; container images that forgot to copy the truststore.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Using insecure protocols with repositories, without explicit
• Setting the working directory of a worker is not supported.
• Cannot parse memory amount notation:
• No main class specified and classpath is not an executable j
• Running a Java module is not supported in this context.

AI-assisted analysis of gradle/gradle@534f27719b (2026-08-22). Data as JSON: /api/errors/a4ea74cd4877ea7f. Report an issue: GitHub.