pentaho/pentaho-kettle · error · KettleException

KettleTrustManager.Exception.CouldNotOpenCertStore

KettleTrustManager.Exception.CouldNotOpenCertStore

Error message

KettleTrustManager.Exception.CouldNotOpenCertStore

What it means

Thrown in the KettleTrustManager constructor when loading the certificate keystore fails: KettleVFS cannot open the cert file, or keyStore.load() rejects the stream/password. The custom trust manager needed for LDAPS cannot be initialized, so secure LDAP connections will fail.

Solutions

1. Verify the certificate file exists and is readable at the configured path
2. Confirm the password matches the keystore (test: keytool -list -keystore file -storepass <pwd>)
3. Convert PEM certificates to a keystore format: keytool -importcert -file cert.pem -keystore trust.jks
4. Check the cause chain for the exact VFS/IO or UnrecoverableKeyException reason

Example fix

// before
Certificate file: /etc/ldap/server.pem, password: changeit
// after
keytool -importcert -file /etc/ldap/server.pem -alias ldapserver -keystore /etc/ldap/truststore.jks -storepass changeit
// configure truststore.jks with password changeit

// Validate truststore path, format and password before configuring the step
File f = new File(certPath);
if (!f.isFile()) throw new FileNotFoundException(certPath);
try (FileInputStream in = new FileInputStream(f)) {
  KeyStore ks = KeyStore.getInstance("JKS");
  ks.load(in, password.toCharArray()); // throws on wrong password/corrupt file
}

try {
  configureTrustStore(certPath, password);
} catch (KettleException e) {
  Throwable c = e.getCause();
  if (c instanceof java.io.FileNotFoundException) { /* fix path */ }
  else if (c instanceof java.io.IOException) { /* wrong password or bad format */ }
  throw new IllegalStateException("Could not open cert store: " + c, c);
}

When it happens

Trigger: KettleVFS.getInputStream(certFilename) throws (file missing/unreadable) or keyStore.load(inputStream, password) throws (wrong password or corrupt/invalid keystore format).

Common situations: Certificate path is wrong or uses an unsupported VFS scheme; password does not match the keystore password; file is not a keystore at all (raw PEM certificate instead of JKS/PKCS12); file permissions block reading.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• KettleTrustManager.Exception.CouldNotCreateCertStore
• Failed to set SSL context:
• KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager
• KettleTrustManager.Exception.CouldNotInitializeTrustManager
• Rest.Error.IOException

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/24dd285357419388. Report an issue: GitHub.

Appendix: source

Thrown at plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java:63

  /**
   *
   * @param certStorePath
   * @param certPassword
   * @throws KettleException
   */
  public KettleTrustManager( Bowl bowl, KeyStore keyStore, String certFilename, String certPassword )
    throws KettleException {
    try {
      // Load the CERT key from the file into the store using the provided
      // password if needed.
      //
      InputStream inputStream = null;
      try {
        inputStream = KettleVFS.getInstance( bowl ).getInputStream( certFilename );
        keyStore.load( inputStream, Const.NVL( certPassword, "" ).toCharArray() );
      } catch ( Exception e ) {
        throw new KettleException( BaseMessages.getString(
          PKG, "KettleTrustManager.Exception.CouldNotOpenCertStore" ), e );
      } finally {
        if ( inputStream != null ) {
          try {
            inputStream.close();
          } catch ( Exception e ) {
            throw new KettleException( BaseMessages.getString(
              PKG, "KettleTrustManager.Exception.CouldNotOpenCertStore" ), e );
          }
        }
      }

      // Now initialize the trust manager...
      //
      try {
        TrustManagerFactory tmf = null;
        tmf = TrustManagerFactory.getInstance( "SunX509" );
        tmf.init( keyStore );

View on GitHub (pinned to f3058517a1)