prestodb/presto · error · RuntimeException

Failed to load truststore

Error message

Failed to load truststore

What it means

loadTrustStore reads the configured truststore file and imports the Redis server certificate(s) into a KeyStore. KeyStoreException, IOException, CertificateException, or NoSuchAlgorithmException during loading are wrapped in a RuntimeException 'Failed to load truststore'. It means the truststore file could not be read or parsed as a keystore/certificate.

Source

Thrown at presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java:169

    {
        if (redisConnectorConfig.getTruststorePath() == null) {
            log.info("No truststore path configured, skipping TLS truststore loading");
            return null;
        }

        try {
            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            try (InputStream in = Files.newInputStream(redisConnectorConfig.getTruststorePath().toPath())) {
                trustStore.load(null, null);
                CertificateFactory cf = CertificateFactory.getInstance("X.509");
                X509Certificate cert = (X509Certificate) cf.generateCertificate(in);
                trustStore.setCertificateEntry("redis-server", cert);
            }
            log.info("Loaded truststore from %s", redisConnectorConfig.getTruststorePath());
            return trustStore;
        }
        catch (KeyStoreException | IOException | CertificateException | NoSuchAlgorithmException e) {
            throw new RuntimeException("Failed to load truststore", e);
        }
    }

    private JedisPool buildJedisPool(HostAddress host, boolean useTls, SSLContext sslContext)
    {
        log.info("Creating new %s JedisPool for %s", useTls ? "TLS" : "non-TLS", host);

        return new JedisPool(
                jedisPoolConfig,
                host.getHostText(),
                host.getPort(),
                toIntExact(redisConnectorConfig.getRedisConnectTimeout().toMillis()),
                JEDIS_SO_TIMEOUT,
                JEDIS_CONN_TIMEOUT,
                redisConnectorConfig.getRedisUser(),
                redisConnectorConfig.getRedisPassword(),
                redisConnectorConfig.getRedisDataBaseIndex(),
                null,

View on GitHub (pinned to 55bb57d202)

Solutions

1. Fix redis.truststore-path to point at an existing, readable keystore file
2. Set redis.truststore-password if the truststore is password protected
3. Regenerate or re-export the truststore in the correct format (e.g. keytool -importcert) and verify with keytool -list
4. Ensure the file is readable by the user running Presto (chown/chmod) and mounted into containers

Example fix

// before
redis.truststore-path=/wrong/dir/truststore.jks
// after
redis.truststore-path=/etc/presto/redis/truststore.jks
redis.truststore-password=changeit

File f = new File(truststorePath);
if (!f.isFile() || !f.canRead()) {
    throw new IllegalArgumentException("truststore not readable: " + truststorePath);
}

try { KeyStore ts = loadTrustStore(); } catch (RuntimeException e) { throw new IllegalStateException("truststore load failed: " + e.getCause(), e.getCause()); }

When it happens

Trigger: redis.truststore-path points to a nonexistent or unreadable file (IOException); the file is not a valid keystore format or is password-protected without redis.truststore-password (KeyStoreException/CertificateException); certificate is malformed.

Common situations: Wrong path in config (typo, container image missing the file); wrong file type (PEM passed where JKS expected, or vice versa depending on loader); permissions denied under the Presto service user; file mounted but empty.

Related errors

• HIVE_METASTORE_INITIALIZE_SSL_ERROR
• KeyStore certificate is expired: ${e.getMessage()}
• Truststore must not be null for TLS connections
• Failed to initialize SSLContext
• Error setting up SSL:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/64473c2045975730. Report an issue: GitHub.