pentaho/pentaho-kettle · error · KettleException

Rest.Error.KeyStoreException

Rest.Error.KeyStoreException

Error message

Rest.Error.KeyStoreException

What it means

setSSLConfiguration wraps java.security.KeyStoreException from HttpClientManager.getSslContext in a KettleException with Rest.Error.KeyStoreException. This occurs when the trust store cannot be loaded or initialized — typically a corrupt store, wrong type, wrong password handling at the KeyStore level, or an uninitialized store.

Solutions

1. Validate the trust store: keytool -list -keystore <file> -storepass <pwd> — fix or recreate if it fails
2. Confirm the store type in the step settings matches the file format (JKS vs PKCS12)
3. Re-import the server certificate into a fresh trust store
4. Verify the trust store path points at the intended file (not a cert PEM or another artifact)
5. Check the cause chain for the precise KeyStoreException reason

Example fix

// before
keytool -list -keystore truststore.jks
// after
keytool -list -keystore truststore.p12 -storetype PKCS12 -storepass changeit

// validate the trust store before configuring SSL
java.io.File ts = new java.io.File( data.trustStoreFile );
if ( !ts.isFile() || ts.length() == 0 ) {
  throw new IllegalStateException( "Trust store missing or empty: " + data.trustStoreFile );
}
java.security.KeyStore ks = java.security.KeyStore.getInstance( "PKCS12" );
try ( var in = new java.io.FileInputStream( ts ) ) {
  ks.load( in, password ); // throws if corrupt or wrong type
}

try {
  step.setConfig( meta, data, row );
} catch ( KettleException e ) {
  if ( e.getMessage().contains( "KeyStoreException" ) ) {
    log.error( "Cannot load trust store — verify file format (JKS vs PKCS12) and integrity", e );
  }
}

When it happens

Trigger: Trust store file is corrupt/not a keystore, the keystore type is wrong for the file format, or getSslContext fails while instantiating the KeyStore from the provided input stream.

Common situations: Trust store file overwritten or truncated; password file/export produced a different store format than assumed; file actually a PEM cert rather than a keystore; wrong store type passed in step settings.

Related errors

• Rest.Error.NoSuchAlgorithm
• Failed to set SSL context:
• KettleTrustManager.Exception.CouldNotCreateCertStore
• KettleTrustManager.Exception.CouldNotOpenCertStore
• Rest.Error.CertificateException

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/4b2c6f63bcfccaeb. Report an issue: GitHub.

Appendix: source

Thrown at plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java:367

              .credentials( data.realHttpLogin, data.realHttpPassword )
              .build();
        }
      }
      // SSL TRUST STORE CONFIGURATION
      setSSLConfiguration( data );
    }
  }

  protected void setSSLConfiguration( RestData data ) throws KettleException {
    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {
      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),
        trustStoreIn,
        data.trustStorePassword );

    } catch ( NoSuchAlgorithmException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.NoSuchAlgorithm" ), e );
    } catch ( KeyStoreException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyStoreException" ), e );
    } catch ( CertificateException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.CertificateException" ), e );
    } catch ( FileNotFoundException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.FileNotFound", data.trustStoreFile ), e );
    } catch ( IOException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.IOException" ), e );
    } catch ( KeyManagementException | UnrecoverableKeyException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyManagementException" ), e );
    }
  }

  /**
   * Get an InputStream for the file with the given name.
   * If the file name is empty or null, returns null.
   *
   * @param fileName the file name to get InputStream from
   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null
   * @throws KettleException if any error occurs while getting the InputStream

View on GitHub (pinned to f3058517a1)