prestodb/presto · error · GeneralSecurityException

Failed to read truststore

Error message

Failed to read truststore

What it means

While validating the truststore, a KeyStoreException from truststore.aliases() (the store was not loaded properly) is wrapped in GeneralSecurityException('Failed to read truststore'). It signals the KeyStore object exists but its entries cannot be enumerated, usually due to load/password problems.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:189

    }

    private X509TrustManager createTrustManager(KeyStore truststore) throws GeneralSecurityException
    {
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(getDefaultAlgorithm());

        // When truststore is null, TrustManagerFactory will use JVM's system default truststore
        // When truststore is not null, validate it contains certificates before using it
        if (truststore != null) {
            try {
                // Check if truststore has any certificates
                List<String> aliases = Collections.list(truststore.aliases());
                if (aliases.isEmpty()) {
                    throw new GeneralSecurityException("Truststore is empty - no trusted certificates found");
                }
                log.debug("Truststore contains {} certificate(s): {}", aliases.size(), aliases);
            }
            catch (KeyStoreException e) {
                throw new GeneralSecurityException("Failed to read truststore", e);
            }
        }

        trustManagerFactory.init(truststore);

        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException("Unexpected default trust managers: " + Arrays.toString(trustManagers));
        }

        return (X509TrustManager) trustManagers[0];
    }

    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)
            throws GeneralSecurityException
    {
        KeyStore trustStore = getInstance(getDefaultType());
        boolean loaded = false;

View on GitHub (pinned to 55bb57d202)

Solutions

1. Inspect the wrapped KeyStoreException cause in the stack trace
2. Re-load the truststore with the correct password (keytool -list to verify)
3. Regenerate the truststore file if corrupted
4. Ensure the same JCE provider/JVM version is used to create and read the store

Example fix

// diagnose
keytool -list -v -keystore truststore.jks -storepass <pass>
// if 'Keystore was tampered with, or password was incorrect' -> fix password or regenerate store

# confirm the store loads correctly before use
keytool -list -v -keystore truststore.jks -storepass $TS_PASS >/dev/null 2>&1 && echo LOADABLE

When it happens

Trigger: createTrustManager (via trustManager) calls truststore.aliases() on a KeyStore instance whose load step did not complete correctly — KeyStoreException is caught and rethrown with this message.

Common situations: Corrupted truststore file; password mismatch causing partial initialization; provider mismatch (store created with a provider unavailable at runtime).

Related errors

• Truststore is empty - no trusted certificates found
• Failed to load truststore as both PEM and KeyStore format. P
• Failed to verify truststore contents
• Unexpected default trust managers:
• KeyStore certificate is expired:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/4e2e9b84ee5fd00d. Report an issue: GitHub.