pentaho/pentaho-kettle · error · KettleException

KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager

KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager

Error message

KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager

What it means

Outer wrapper exception in the KettleTrustManager constructor: any Exception during the whole trust-manager initialization (including the inner CouldNotInitializeTrustManager path) is rethrown with this message. It signals the custom trust manager object could not be constructed at all, so the LDAPS socket factory cannot be configured.

Solutions

Look at the cause chain to find whether init or the cast failed
Populate the keystore with the server certificate (keytool -importcert)
Confirm the JVM supports SunX509 TrustManagerFactory
Replace an empty/corrupt truststore file and retry the LDAPS connection

Example fix

// before
KettleTrustManager with empty or corrupt truststore -> init fails
// after
keytool -importcert -alias ldap -file ldapserver.crt -keystore truststore.jks -storepass changeit
// reconfigure the step to point at truststore.jks

Defensive patterns

Strategy: try-catch

Validate before calling

KeyStore ks = KeyStore.getInstance("JKS");
try (FileInputStream in = new FileInputStream(ksFile)) { ks.load(in, pwd.toCharArray()); }
if (ks.size() == 0) throw new IllegalStateException("Empty truststore: import the LDAP server certificate first");

Try / catch

try {
  configureTrustStore(ksFile, pwd);
} catch (KettleException e) {
  log.error("KettleTrustManager init failed; cause chain:", e); // walk to root cause
  throw new IllegalStateException("LDAPS setup failed: " + e.getCause(), e.getCause());
}

Prevention

Always populate the truststore with the server cert (keytool -importcert -noprompt)
Test LDAPS connectivity outside Pentaho first (openssl s_client -connect host:636)
Regenerate corrupt truststore files rather than editing them

When it happens

Trigger: Any exception escaping the outer try in the constructor — keyStore load failures are handled separately, so this typically wraps TrustManagerFactory setup or cast errors (tms[0] not an X509TrustManager).

Common situations: Same root causes as trust manager init failure: empty/invalid keystore, missing SunX509 algorithm, broken JVM security providers; also ClassCastException when the first trust manager is not X509.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/5e1583d6416b1442. Report an issue: GitHub.

Appendix: source

Thrown at plugins/ldap/impl/src/main/java/org/pentaho/di/trans/steps/ldapinput/store/KettleTrustManager.java:89

              PKG, "KettleTrustManager.Exception.CouldNotOpenCertStore" ), e );
          }
        }
      }

      // Now initialize the trust manager...
      //
      try {
        TrustManagerFactory tmf = null;
        tmf = TrustManagerFactory.getInstance( "SunX509" );
        tmf.init( keyStore );
        TrustManager[] tms = tmf.getTrustManagers();
        tm = (X509TrustManager) tms[0];
      } catch ( Exception e ) {
        throw new KettleException( BaseMessages.getString(
          PKG, "KettleTrustManager.Exception.CouldNotInitializeTrustManager" ), e );
      }
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString(
        PKG, "KettleTrustManager.Exception.CouldNotInitializeKettleTrustManager" ), e );
    }
  }

  /**
   * Pass method from x509TrustManager to this class...
   *
   * @return an array of certificate authority certificates which are trusted for authenticating peers
   */
  public X509Certificate[] getAcceptedIssuers() {
    if ( tm == null ) {
      return null;
    }
    return tm.getAcceptedIssuers();
  }

  /**
   * Pass method from x509TrustManager to this class...

View on GitHub (pinned to f3058517a1)