pentaho/pentaho-kettle · error · KettleException

KettleTrustManager.Exception.CouldNotCreateCertStore

KettleTrustManager.Exception.CouldNotCreateCertStore

Error message

KettleTrustManager.Exception.CouldNotCreateCertStore

What it means

Thrown by CustomSocketFactory.configure() when instantiating the KeyStore for the client certificate fails (KeyStore.getInstance or related setup throws). This happens while setting up the SSL socket factory for secure LDAP (LDAPS). Without a valid keystore object the TLS trust manager cannot be built, so the secure connection setup aborts.

Solutions

1. Verify the certificate file is a valid keystore: keytool -list -keystore cert.p12
2. Ensure a .p12/.pfx file is named with the .p12 extension (or convert it), since only that suffix selects PKCS12
3. Regenerate/convert the certificate: keytool -importkeystore to produce a fresh JKS
4. Check the JVM provider configuration (java.security) if PKCS12 support is missing

Example fix

// before
my-cert.pfx  (renamed to my-cert.jks in the dialog)
// after
keytool -importkeystore -srckeystore my-cert.pfx -srcstoretype pkcs12 -destkeystore my-cert.jks -deststoretype jks
// then configure the step with my-cert.jks

// Validate certificate file before configuring LDAPS
File f = new File(certPath);
if (!f.isFile() || f.length() == 0) throw new IllegalStateException("Bad cert path: " + certPath);
// verify format
try (FileInputStream in = new FileInputStream(f)) {
  KeyStore ks = KeyStore.getInstance(certPath.endsWith(".p12") ? "PKCS12" : "JKS");
  ks.load(in, password.toCharArray());
}

try {
  configureLdapStep(certPath, password);
} catch (KettleException e) {
  throw new IllegalStateException("Cert store creation failed: " + e.getCause(), e.getCause());
}

When it happens

Trigger: configure() is called with a certificate path set, and KeyStore.getInstance("PKCS12") or KeyStore.getInstance("JKS") (or keystore initialization) throws because the keystore type/provider is unavailable or the keystore setup is invalid.

Common situations: Certificate file is not actually PKCS12 or JKS format; JVM lacks the PKCS12 provider; the path points to a corrupt or zero-byte file; wrong file extension forces the wrong keystore type (only .p12 is detected as PKCS12, .pfx is not).

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• KettleTrustManager.Exception.CouldNotOpenCertStore
• Failed to set SSL context:
• KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager
• KettleTrustManager.Exception.CouldNotInitializeTrustManager
• Rest.Error.IOException

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/abb77359ea47a973. Report an issue: GitHub.

Appendix: source

Thrown at plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/CustomSocketFactory.java:95

  }

  /**
   * Configures this SSLSocketFactory so that it uses the given keystore as its truststore.
   */
  public static synchronized void configure( Bowl bowl, String path, String password ) throws KettleException {

    // Get the appropriate key-store based on the file path...
    //
    KeyStore keyStore;

    try {
      if ( !Utils.isEmpty( path ) && path.endsWith( ".p12" ) ) {
        keyStore = KeyStore.getInstance( "PKCS12" );
      } else {
        keyStore = KeyStore.getInstance( "JKS" );
      }
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString(
        PKG, "KettleTrustManager.Exception.CouldNotCreateCertStore" ), e );
    }

    trustManagers = new KettleTrustManager[] { new KettleTrustManager( bowl, keyStore, path, password ) };
    configured.set( true );
  }

  /**
   * Configures this SSLSocketFactory so that it trusts any signer.
   */
  public static synchronized void configure() {
    trustManagers = ALWAYS_TRUST_MANAGER;
    configured.set( true );
  }

  @Override
  public Socket createSocket( String host, int port ) throws IOException, UnknownHostException {
    return factory.createSocket( host, port );

View on GitHub (pinned to f3058517a1)