pentaho/pentaho-kettle · error · KettleException

Rest.Error.KeyManagementException

Rest.Error.KeyManagementException

Error message

Rest.Error.KeyManagementException

What it means

Wraps KeyManagementException or UnrecoverableKeyException thrown when initializing the SSLContext in setSSLConfiguration (called by setConfig); the localized message is 'Key management error'. It means the JVM could not build the SSL key/trust managers from the supplied key material.

Solutions

1. Set the step's key store password AND key password to the same value, or re-import the key with keytool so the key password matches the store password.
2. Check the runtime JDK: install JCE unlimited strength policy files (Java 8 < u161) or upgrade to a JDK that supports the cipher/key used.
3. Re-generate the key pair with a standard algorithm: keytool -genkeypair -keyalg RSA -keysize 2048.
4. Enable -javax.net.debug=ssl,handshake and rerun to see which manager initialization fails.

Example fix

// before — key password differs from store password
keytool -importkeystore ... -destkeypass othersecret
// after — same password for store and key
keytool -importkeystore -srckeystore client.p12 -destkeystore client.jks -deststorepass secret -destkeypass secret

// Verify key material is recoverable before use
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream(keyStoreFile), storePass.toCharArray());
Key key = ks.getKey(alias, keyPass.toCharArray()); // throws UnrecoverableKeyException if wrong
if (key == null) throw new IllegalStateException("Key not recoverable: " + alias);

try { setSSLConfiguration(); } catch (KettleException e) {
  if (e.getCause() instanceof KeyManagementException || e.getCause() instanceof UnrecoverableKeyException) {
    /* re-check key password / JDK crypto policy */
  }
  throw e;
}

When it happens

Trigger: SSLContext.init(...) fails because the key store's key password differs from the store password (UnrecoverableKeyException) or the key algorithm/provider is unavailable (KeyManagementException); occurs whenever the REST step configures a trust store or key store for HTTP client SSL.

Common situations: PKCS#12 store where key password != store password; JCE unlimited-strength policy files missing for strong ciphers on old JDKs; key store with keys the default SunX509 algorithm cannot recover; mismatched Java provider versions after a JDK upgrade.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Failed to set SSL context:
• Rest.Error.IOException
• KettleTrustManager.Exception.CouldNotCreateCertStore
• KettleTrustManager.Exception.CouldNotOpenCertStore
• Rest.Error.FileNotFound

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/6a618d26786285d3. Report an issue: GitHub.

Appendix: source

Thrown at plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java:375

  protected void setSSLConfiguration( RestData data ) throws KettleException {
    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {
      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),
        trustStoreIn,
        data.trustStorePassword );

    } catch ( NoSuchAlgorithmException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.NoSuchAlgorithm" ), e );
    } catch ( KeyStoreException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyStoreException" ), e );
    } catch ( CertificateException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.CertificateException" ), e );
    } catch ( FileNotFoundException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.FileNotFound", data.trustStoreFile ), e );
    } catch ( IOException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.IOException" ), e );
    } catch ( KeyManagementException | UnrecoverableKeyException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyManagementException" ), e );
    }
  }

  /**
   * Get an InputStream for the file with the given name.
   * If the file name is empty or null, returns null.
   *
   * @param fileName the file name to get InputStream from
   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null
   * @throws KettleException if any error occurs while getting the InputStream
   */
  protected InputStream getInputStream( String fileName ) throws KettleException {
    InputStream inputStream = null;

    if ( !StringUtil.isEmpty( fileName ) ) {
      fileName = fileName.trim();
      if ( !StringUtil.isEmpty( fileName ) ) {
        inputStream = KettleVFS.getInstance( this.getTransMeta().getBowl() ).getInputStream( fileName );

View on GitHub (pinned to f3058517a1)