pentaho/pentaho-kettle · error · CertificateException

Client Authentication not implemented

Error message

Client Authentication not implemented

What it means

This error comes from the setEnvironmentVar scripting function in Pentaho Kettle's JavaScript step. When System.setProperty throws any exception (e.g. a SecurityManager blocks the write or the key/value cannot be converted), the function wraps the exception's toString() into a Mozilla Rhino JavaScriptRuntime error. The message is deliberately the raw exception text because the original cause is unknown at throw time.

Solutions

1. Pass plain string or number arguments: setEnvironmentVar('MY_KEY', 'myValue').
2. Check for a SecurityManager / security policy that blocks System.setProperty and grant the needed property-write permission.
3. Verify the JVM allows setting properties at that point (some restricted embedders forbid it).
4. If you only need the value within the transformation, use a Kettle variable via setVariable instead of a JVM system property.

Example fix

// before
setEnvironmentVar(myComplexObject, 42);
// after
setEnvironmentVar("MY_KEY", String(myComplexObject) || "default");

var k = String(key), v = String(val);
if (k === "" ) throw new Error("setEnvironmentVar: empty key");

function isPlainValue(x) { return x != null && (typeof x === "string" || typeof x === "number"); }

try {
  setEnvironmentVar("MY_KEY", "myValue");
} catch (e) {
  // e contains the wrapped Java exception; fall back to a Kettle variable
  setVariable("MY_KEY", "myValue", "");
}

When it happens

Trigger: Calling setEnvironmentVar(a, b) with exactly 2 arguments where Context.toString() conversion or System.setProperty throws - e.g. a SecurityManager denies property writes, or the argument is a hostile/unconvertible Scriptable object.

Common situations: Running the transformation in a sandboxed/app-server environment with a SecurityManager; passing non-primitive JavaScript objects whose toString fails; calling the function during restricted JVM startup.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Argument of TRUNC of date has to be between 0 and 5
• Argument of TRUNC of date has to be between 0 and 5
• Could not apply the local format for locale " + sArg3 + "…
• Could not convert to local format.
• Could not convert to the given format.

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/1e623d017b84932e. Report an issue: GitHub.

Appendix: source

Thrown at core/src/main/java/org/pentaho/di/cluster/SlaveConnectionManager.java:125

    return
      HttpClientBuilder
        .create()
        .setDefaultCredentialsProvider( provider )
        .setDefaultRequestConfig( requestConfig )
        .setConnectionManager( manager )
        .build();
  }

  public void shutdown() {
    manager.shutdown();
  }

  private static X509TrustManager getDefaultTrustManager() {
    return new X509TrustManager() {
      @Override
      public void checkClientTrusted( X509Certificate[] certs, String param ) throws CertificateException {
        throw new CertificateException( "Client Authentication not implemented" );
      }

      @Override
      public void checkServerTrusted( X509Certificate[] certs, String param ) throws CertificateException {
        for ( X509Certificate cert : certs ) {
          cert.checkValidity(); // validate date
          // cert.verify( key ); // check by Public key
          // cert.getBasicConstraints()!=-1 // check by CA
        }
      }

      @Override
      public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
      }
    };
  }

View on GitHub (pinned to f3058517a1)