pentaho/pentaho-kettle · error · KettleException

Rest.Error.NoSuchAlgorithm

Rest.Error.NoSuchAlgorithm

Error message

Rest.Error.NoSuchAlgorithm

What it means

setSSLConfiguration loads the trust store via HttpClientManager.getSslContext; a java.security.NoSuchAlgorithmException is wrapped in a KettleException with Rest.Error.NoSuchAlgorithm. It means the JRE does not recognize the algorithm needed to build the SSL context / trust store.

Solutions

1. Check the cause message to identify the missing algorithm
2. Regenerate the trust store with the JVM's own keytool (e.g. keytool -importcert -storetype PKCS12) so the algorithm matches the runtime
3. Ensure a full JDK/JRE with standard crypto providers (SUN, SunJSSE) is being used — check JAVA_HOME
4. Update the JVM/Pentaho to a version supporting the store's algorithm
5. Avoid custom trust store entirely if only 'ignore SSL' behavior is needed

Example fix

// before
keytool -importcert -file server.crt -keystore truststore.jks
// after
keytool -importcert -file server.crt -keystore truststore.p12 -storetype PKCS12 -storepass changeit

// verify the JVM can instantiate the keystore algorithm before the step runs
try {
  java.security.KeyStore.getInstance( "PKCS12" );
} catch ( java.security.KeyStoreException e ) {
  throw new IllegalStateException( "JVM lacks required keystore providers: " + e.getMessage() );
}

try {
  step.setConfig( meta, data, row );
} catch ( KettleException e ) {
  if ( e.getMessage().contains( "NoSuchAlgorithm" ) ) {
    log.error( "Trust store algorithm unsupported by this JVM — recreate store with the runtime's keytool", e );
  }
}

When it happens

Trigger: Trust store file declares or requires a KeyStore algorithm unsupported by the runtime JVM (e.g. PKCS12-only keytool store vs old JCE providers, or a restricted JRE without TLS1.2/1.3 support).

Common situations: Trust store created with a newer keytool than the JVM running Pentaho; running on a stripped-down JRE lacking crypto providers; mismatched JAVA_HOME between store creation and runtime.

Related errors

• Rest.Error.KeyStoreException
• Failed to set SSL context:
• KettleTrustManager.Exception.CouldNotCreateCertStore
• KettleTrustManager.Exception.CouldNotOpenCertStore
• Rest.Error.CertificateException

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/03fce4cc604997be. Report an issue: GitHub.

Appendix: source

Thrown at plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java:365

          data.basicAuthentication =
            HttpAuthenticationFeature.basicBuilder()
              .credentials( data.realHttpLogin, data.realHttpPassword )
              .build();
        }
      }
      // SSL TRUST STORE CONFIGURATION
      setSSLConfiguration( data );
    }
  }

  protected void setSSLConfiguration( RestData data ) throws KettleException {
    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {
      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),
        trustStoreIn,
        data.trustStorePassword );

    } catch ( NoSuchAlgorithmException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.NoSuchAlgorithm" ), e );
    } catch ( KeyStoreException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyStoreException" ), e );
    } catch ( CertificateException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.CertificateException" ), e );
    } catch ( FileNotFoundException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.FileNotFound", data.trustStoreFile ), e );
    } catch ( IOException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.IOException" ), e );
    } catch ( KeyManagementException | UnrecoverableKeyException e ) {
      throw new KettleException( BaseMessages.getString( PKG, "Rest.Error.KeyManagementException" ), e );
    }
  }

  /**
   * Get an InputStream for the file with the given name.
   * If the file name is empty or null, returns null.
   *
   * @param fileName the file name to get InputStream from

View on GitHub (pinned to f3058517a1)