What causes "Failed to set SSL context: " in pentaho/pentaho-kettle?

Verify the trust store / key store passwords are correct; a wrong password is the most common cause.

pentaho/pentaho-kettle · error · RuntimeException

Failed to set SSL context:

Error message

Failed to set SSL context:

What it means

HttpClientManager wraps any failure while constructing a javax.net.ssl.SSLContext (from the supplied trust store / key store streams) into a RuntimeException with the message "Failed to set SSL context: " plus the underlying cause message. It is thrown when getSslContext cannot build a valid SSL context for the HTTP client builder, so no connection is attempted. The original exception is chained as the cause.

Solutions

Verify the trust store / key store passwords are correct; a wrong password is the most common cause.
Check that the keystore file exists, is readable and is in a supported format (convert JKS to PKCS12 with keytool if needed).
Look at the chained cause exception (e.getCause()) in your log to identify the exact SSL failure.
If the endpoint uses a self-signed certificate, import it into the trust store with keytool -importcert, or set ignoreSsl=true for testing only.
Confirm the JDK supports the requested TLS protocol/algorithm (check java.version and security properties).

Example fix

// before
HttpClientManager.getInstance().createHttpClientBuilder(false, trustStream, "wrongpass", null, null, null);
// after
HttpClientManager.getInstance().createHttpClientBuilder(false, trustStream, "changeit", null, null, null);

Defensive patterns

Strategy: try-catch

Validate before calling

// before building the client
if (trustStoreStream == null || trustStorePassword == null) {
  throw new IllegalArgumentException("Trust store stream and password are required");
}
// optionally verify the keystore loads:
new java.security.KeyStore().load; // see pattern below

Try / catch

try {
  HttpClientManager.getInstance().createHttpClientBuilder(...);
} catch (RuntimeException e) {
  log.error("SSL context setup failed: " + e.getCause(), e); // inspect the cause
  throw new KettleException("Check keystore paths/passwords", e);
}

Prevention

Test keystore loading standalone with `keytool -list -keystore file` before wiring it in.
Keep keystore passwords in environment variables, not hardcoded strings that may be edited incorrectly.
Prefer PKCS12 format for cross-JDK-version compatibility.

When it happens

Trigger: Calling HttpClientManager.buildHttpClient / openHttpClient (e.g. via Kettle's HTTP steps or SLF4J/httputil helpers) with ignoreSsl=false and an invalid trustStoreStream/keyStoreStream, a wrong trustStorePassword/keyStorePassword, a corrupted or unsupported keystore format, or an unavailable TLS algorithm.

Common situations: Typo in the JVM trust store password; keystore exported in a format the JVM doesn't support (e.g. JKS vs PKCS12 differences across Java versions); self-signed certificate handling configured with a bad keystore file path; running on a JVM missing the requested TLS algorithm (e.g. old algorithm removed in newer JDK).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/8faec40b594511b9. Report an issue: GitHub.

Appendix: source

Thrown at core/src/main/java/org/pentaho/di/core/util/HttpClientManager.java:182

        requestConfigBuilder.setProxy( proxy );
      }
      httpClientBuilder.setDefaultRequestConfig( requestConfigBuilder.build() );

      if ( provider != null ) {
        httpClientBuilder.setDefaultCredentialsProvider( provider );
      }
      if ( redirectStrategy != null ) {
        httpClientBuilder.setRedirectStrategy( redirectStrategy );
      }

      if ( trustStoreStream != null || keyStoreStream != null || ignoreSsl ) {
        try {
          SSLContext sslContext =
            HttpClientManager.getSslContext( ignoreSsl, trustStoreStream, trustStorePassword, keyStoreStream,
              keyStorePassword, keyPassword );
          httpClientBuilder.setSSLContext( sslContext );
        } catch ( Exception e ) {
          throw new RuntimeException( "Failed to set SSL context: " + e.getMessage(), e );
        }
      }

      return httpClientBuilder.build();
    }
  }

  public static SSLContext getSslContext( boolean ignoreSSLValidation, InputStream trustFileStream,
                                          String trustStorePassword )
    throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException, KeyManagementException,
    UnrecoverableKeyException {
    return getSslContext( ignoreSSLValidation, trustFileStream, trustStorePassword, null, null, null );
  }

  /**
   * @param ignoreSSLValidation if {@code true} will accept all certificates and any supplied trust file will be ignored
   * @param trustFileStream trust store file
   * @param trustStorePassword trust store password

View on GitHub (pinned to f3058517a1)