prestodb/presto · error · RuntimeException

Failed to initialize SSLContext

Error message

Failed to initialize SSLContext

What it means

After initializing the TrustManagerFactory, createSslContext calls SSLContext.getInstance(TLS_PROTOCOL) and init(); SSL/TLS APIs throw NoSuchAlgorithmException, KeyStoreException, or KeyManagementException, which are wrapped in a RuntimeException 'Failed to initialize SSLContext'. It indicates the JVM/TLS provider could not build the SSL context.

Source

Thrown at presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java:134

     * Creates SSLContext initialized with the given truststore.
     */
    private SSLContext createSslContext(KeyStore trustStore)
    {
        if (trustStore == null) {
            throw new IllegalStateException("Truststore must not be null for TLS connections");
        }

        try {
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(getDefaultAlgorithm());
            tmf.init(trustStore);

            SSLContext sslContext = SSLContext.getInstance(TLS_PROTOCOL);
            sslContext.init(null, tmf.getTrustManagers(), null);

            return sslContext;
        }
        catch (NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) {
            throw new RuntimeException("Failed to initialize SSLContext", e);
        }
    }

    private JedisPoolConfig createJedisPoolConfig()
    {
        JedisPoolConfig config = new JedisPoolConfig();
        config.setMinIdle(JEDIS_MIN_IDLE_CONNECTIONS);
        config.setMaxTotal(JEDIS_MAX_IDLE_CONNECTIONS);
        return config;
    }

    /**
     * Loads the truststore containing Redis server certificate.
     * Returns null if truststore path is not configured.
     */
    private KeyStore loadTrustStore()
    {
        if (redisConnectorConfig.getTruststorePath() == null) {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check the JDK version supports the TLS protocol version and includes standard security providers
2. Inspect the wrapped cause (e.getCause()) for the real NoSuchAlgorithmException/KeyStoreException/KeyManagementException
3. Verify the truststore file is a valid JKS/PKCS12 and not corrupt
4. Restore the default java.security provider list if it was customized

Example fix

// before: custom security providers removed TLS
// after: restore default providers or use a supported protocol
-Djava.security.properties=/etc/presto/java.security

try { SSLContext ctx = SSLContext.getInstance("TLS"); ctx.init(null, tmf.getTrustManagers(), null); } catch (RuntimeException e) { throw new IllegalStateException("SSL init failed: " + e.getCause(), e.getCause()); }

When it happens

Trigger: The JVM lacks the requested TLS protocol algorithm (unusual JDK builds or old JDKs); the TrustManagerFactory produced no/invalid trust managers due to a bad truststore; KeyManagementException from invalid SSLContext init parameters.

Common situations: Running on a stripped or very old JDK without TLS support; security provider misconfiguration (java.security edits); corrupted JKS truststore previously loaded fine but rejected at init.

Related errors

• Truststore must not be null for TLS connections
• Failed to load truststore
• Error setting up SSL:
• Unexpected default trust managers:
• KeyStore certificate is expired:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/68f7962097bf8be5. Report an issue: GitHub.