pentaho/pentaho-kettle · error · KettleException

KettleTrustManager.Exception.CouldNotInitializeTrustManager

KettleTrustManager.Exception.CouldNotInitializeTrustManager

Error message

KettleTrustManager.Exception.CouldNotInitializeTrustManager

What it means

Thrown when the default JVM TrustManagerFactory (SunX509) cannot be created or initialized with the loaded keystore, so the X509TrustManager cannot be obtained. This is the inner failure of KettleTrustManager's initialization, typically meaning the keystore is empty/invalid or the security provider setup is broken.

Solutions

Ensure the keystore contains trustedCertEntry entries: keytool -list -keystore truststore.jks
Import the LDAP server certificate into the keystore with keytool -importcert
Check java.security providers; on unusual JVMs try a different TrustManagerFactory algorithm
Verify the keystore loaded non-null before constructing the trust manager

Example fix

// before (empty truststore)
keytool -list -keystore trust.jks  ->  0 entries
// after
keytool -importcert -alias ldapserver -file server.crt -keystore trust.jks -storepass changeit -noprompt

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the keystore actually contains entries before building the trust manager
KeyStore ks = KeyStore.getInstance("JKS");
try (FileInputStream in = new FileInputStream(ksFile)) { ks.load(in, pwd.toCharArray()); }
if (ks.size() == 0) throw new IllegalStateException("Truststore has no certificate entries");

Try / catch

try {
  configureTrustStore(ksFile, pwd);
} catch (KettleException e) {
  Throwable c = e.getCause();
  if (c instanceof java.security.NoSuchAlgorithmException) { /* JVM lacks SunX509; check java.security */ }
  throw new IllegalStateException("Trust manager init failed: " + c, c);
}

Prevention

Import the LDAP server certificate so the truststore is non-empty
Verify SunX509 support on non-standard JVMs
Keep JVM java.security provider configuration intact

When it happens

Trigger: TrustManagerFactory.getInstance("SunX509") throws NoSuchAlgorithmException, or tmf.init(keyStore) / getTrustManagers() throws (null or invalid keystore, or tms[0] is not X509TrustManager).

Common situations: Keystore loaded but contains no trusted certificate entries; keystore is null due to an earlier silent failure; non-JVM-standard provider environment lacking SunX509; corrupted JVM security config (java.security).

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/0fadb3e3862b22f2. Report an issue: GitHub.

Appendix: source

Thrown at plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java:85

          try {
            inputStream.close();
          } catch ( Exception e ) {
            throw new KettleException( BaseMessages.getString(
              PKG, "KettleTrustManager.Exception.CouldNotOpenCertStore" ), e );
          }
        }
      }

      // Now initialize the trust manager...
      //
      try {
        TrustManagerFactory tmf = null;
        tmf = TrustManagerFactory.getInstance( "SunX509" );
        tmf.init( keyStore );
        TrustManager[] tms = tmf.getTrustManagers();
        tm = (X509TrustManager) tms[0];
      } catch ( Exception e ) {
        throw new KettleException( BaseMessages.getString(
          PKG, "KettleTrustManager.Exception.CouldNotInitializeTrustManager" ), e );
      }
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString(
        PKG, "KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager" ), e );
    }
  }

  /**
   * Pass method from x509TrustManager to this class...
   *
   * @return an array of certificate authority certificates which are trusted for authenticating peers
   */
  public X509Certificate[] getAcceptedIssuers() {
    if ( tm == null ) {
      return null;
    }
    return tm.getAcceptedIssuers();

View on GitHub (pinned to f3058517a1)