prestodb/presto · error · ClientException

Error setting up SSL:

Error message

Error setting up SSL: 

What it means

OkHttpUtil.setupInsecureSsl installs a trust-all TrustManager to allow HTTPS to servers without valid certificates. Building that SSLContext (KeyManagerFactory, TrustManagerFactory, or sslContext.init) can throw a GeneralSecurityException, which the library wraps in this ClientException with the underlying message appended.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java:175

                {
                    // skip validation of server certificate
                }

                @Override
                public X509Certificate[] getAcceptedIssuers()
                {
                    return new X509Certificate[0];
                }
            };

            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, new TrustManager[] {trustAllCerts}, new SecureRandom());

            clientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustAllCerts);
            clientBuilder.hostnameVerifier((hostname, session) -> true);
        }
        catch (GeneralSecurityException e) {
            throw new ClientException("Error setting up SSL: " + e.getMessage(), e);
        }
    }

    public static void setupSsl(
            OkHttpClient.Builder clientBuilder,
            Optional<String> keyStorePath,
            Optional<String> keyStorePassword,
            Optional<String> keystoreType,
            Optional<String> trustStorePath,
            Optional<String> trustStorePassword,
            Optional<String> trustStoreType)
    {
        if (!keyStorePath.isPresent() && !trustStorePath.isPresent()) {
            return;
        }

        try {
            // load KeyStore if configured and get KeyManagers

View on GitHub (pinned to 55bb57d202)

Solutions

1. Read the wrapped exception's message/cause (ClientException.getCause()) to identify which security setup step failed.
2. Verify the JVM's security providers with a minimal TLS smoke test (SSLContext.getInstance("TLS").init(...)) outside Presto.
3. Remove or fix custom java.security / provider overrides and ensure standard JCE providers are present.
4. As a fallback, skip setupInsecureSsl and rely on a properly configured truststore via setupSsl with valid certs.

Example fix

// before
OkHttpUtil.setupInsecureSsl(builder, Optional.empty()); // ClientException: Error setting up SSL
// after
try {
    OkHttpUtil.setupInsecureSsl(builder, Optional.empty());
} catch (ClientException e) {
    LOG.warn("Insecure SSL setup failed: {}", e.getCause(), e);
    throw e;
}

try { SSLContext.getInstance("TLS"); TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); } catch (GeneralSecurityException e) { /* JCE/provider environment is broken; fix JDK security config before enabling insecure SSL */ }

try { OkHttpUtil.setupInsecureSsl(builder, Optional.empty()); } catch (ClientException e) { /* inspect e.getCause() (GeneralSecurityException) and fix providers/policies */ }

When it happens

Trigger: Calling setupInsecureSsl on a JVM where the security provider cannot create the trust-all TrustManager or initialize the SSLContext — e.g. broken JCE provider configuration, restricted crypto policy, or corrupted keystore/truststore defaults on the classpath.

Common situations: Custom java.security files overriding security providers; unusual JDKs (limited crypto builds); ClassLoader picking up a bad keystore via javax.net.ssl defaults; running in a stripped-down container missing TLS provider JARs.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• Authentication using username/password requires SSL to be en
• GENERIC_INTERNAL_ERROR
• Loaded truststore is empty - no certificates found in:
• Truststore must not be null for TLS connections

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/cd33dcbdb819e732. Report an issue: GitHub.