prestodb/presto · error · GeneralSecurityException

Failed to verify truststore contents

Error message

Failed to verify truststore contents

What it means

While verifying the loaded truststore's aliases, the alias enumeration itself can throw KeyStoreException (the keystore is in an unreadable/unloaded state). loadTrustStore wraps that in a GeneralSecurityException with message "Failed to verify truststore contents", keeping the original KeyStoreException as the cause.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:258

            catch (IOException | GeneralSecurityException e) {
                log.debug("Failed to load truststore as JKS format: {}", e.getMessage());
                throw new GeneralSecurityException(
                        "Failed to load truststore as both PEM and KeyStore format. " +
                                "PEM error: " + (lastException != null ? lastException.getMessage() : "unknown") +
                                ", KeyStore error: " + e.getMessage(), e);
            }
        }

        // Verify the truststore is not empty
        try {
            List<String> aliases = Collections.list(trustStore.aliases());
            if (aliases.isEmpty()) {
                throw new GeneralSecurityException("Loaded truststore is empty - no certificates found in: " + trustStorePath);
            }
            log.debug("Truststore loaded with {} certificate(s)", aliases.size());
        }
        catch (KeyStoreException e) {
            throw new GeneralSecurityException("Failed to verify truststore contents", e);
        }

        return trustStore;
    }

    private static void validateCertificates(KeyStore keyStore) throws GeneralSecurityException
    {
        for (String alias : list(keyStore.aliases())) {
            if (!keyStore.isKeyEntry(alias)) {
                continue;
            }

            Certificate certificate = keyStore.getCertificate(alias);
            if (!(certificate instanceof X509Certificate)) {
                continue;
            }

            try {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Inspect the cause (KeyStoreException) in the stack trace to find the underlying keystore failure
2. Re-create the truststore with keytool and retry with a known-good file
3. Confirm the password and file format (JKS vs PKCS12) match what was passed to KeyStore.getInstance/load
4. Upgrade/verify the JCE provider if a non-default KeyStore provider is configured

java
KeyStore ks = KeyStore.getInstance(type);
try (InputStream in = Files.newInputStream(path)) { ks.load(in, password); }
ks.size(); // forces enumeration; surfaces KeyStoreException early

java
try {
    sslContext = provider.createSSLContext(config);
} catch (GeneralSecurityException e) {
    Throwable cause = e.getCause();
    if (cause instanceof KeyStoreException) {
        log.error("Corrupt/unloadable truststore: " + cause.getMessage());
    }
    throw e;
}

When it happens

Trigger: loadTrustStore's try block calls trustStore.aliases() on a KeyStore whose provider/state makes enumeration fail — rare, usually a corrupted store or a KeyStore instance that was not properly loaded.

Common situations: Corrupted truststore file (partial write, wrong password tolerated by some formats), a custom KeyStore provider misbehaving, or concurrency where the store is reloaded mid-verification.

Related errors

• Failed to read truststore
• Loaded truststore is empty - no certificates found in:
• KeyStore certificate '%s' is expired:
• Error setting up SSL:
• Unexpected default trust managers:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8795f4ebe8cc032e. Report an issue: GitHub.