prestodb/presto · error · PrestoException

GENERIC_INTERNAL_ERROR

GENERIC_INTERNAL_ERROR

Error message

Failed to initialize SSL context

What it means

SslContextProvider.buildSslContext catches GeneralSecurityException and IOException while assembling the SSLContext (loading keystores, truststores, initializing key/trust managers) and rethrows them as a PrestoException with code GENERIC_INTERNAL_ERROR. The named log line contains the underlying cause.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:96

     * @return Optional SSLContext, empty if no SSL configuration is provided
     * @throws PrestoException if SSL context creation fails
     */
    public Optional<SSLContext> buildSslContext()
    {
        if (!keystorePath.isPresent() && !truststorePath.isPresent()) {
            log.debug("No SSL configuration provided, returning empty SSL context");
            return Optional.empty();
        }

        try {
            log.debug("Creating SSL context with keystore: {}, truststore: {}",
                    keystorePath.map(File::getPath).orElse("none"),
                    truststorePath.map(File::getPath).orElse("none"));
            return Optional.of(createSSLContext());
        }
        catch (GeneralSecurityException | IOException e) {
            log.error("Failed to initialize SSL context", e);
            throw new PrestoException(GENERIC_INTERNAL_ERROR, "Failed to initialize SSL context", e);
        }
    }

    private SSLContext createSSLContext() throws GeneralSecurityException, IOException
    {
        // Load KeyStore if configured and get KeyManagers
        KeyStore keystore = null;
        KeyManager[] keyManagers = null;

        if (keystorePath.isPresent()) {
            log.debug("Loading keystore from: {}", keystorePath.get().getPath());
            keystore = loadKeyStore();
            keyManagers = createKeyManagers(keystore);
            log.debug("Keystore loaded successfully");
        }

        // Load TrustStore if configured, otherwise use KeyStore for backward compatibility
        // If neither is configured, use system default

View on GitHub (pinned to 55bb57d202)

Solutions

1. Read the log stack trace at 'Failed to initialize SSL context' for the root cause
2. Verify the keystore/truststore file paths exist and are readable by the Presto process
3. Confirm passwords match the store; check the format (PEM vs JKS/PKCS12) matches what the provider expects
4. Regenerate or convert the store (keytool -importkeystore / openssl) if the format or algorithm is unsupported

Example fix

// before (catalog.properties)
http-server.https.keystore.path=/etc/pki/wrong.jks
// after
http-server.https.keystore.path=/etc/presto/keystore.jks
http-server.https.keystore.key=correctpassword

# pre-flight checks before starting Presto
keytool -list -keystore $KS_PATH -storepass $KS_PASS >/dev/null && \
openssl x509 -in $CERT_PEM -noout >/dev/null && echo SSL-OK

try {
    sslContextProvider.sslContext(...);
} catch (PrestoException e) {
    if (GENERIC_INTERNAL_ERROR.getCode() == e.getErrorCode()) {
        log.error("SSL init failed; check store paths/passwords", e.getCause());
    }
    throw e;
}

When it happens

Trigger: configureTls/initialize/sslContext call buildSslContext and loading fails: keystore/truststore file missing or unreadable, wrong password, unsupported keystore format, or any KeyStore/TrustManager initialization exception.

Common situations: Typo'd keystore path in catalog properties; wrong keystore/truststore password; PEM vs JKS format confusion; file permissions after container image change; JVM missing the crypto provider for the stored key algorithm.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Error setting up SSL:
• Unexpected default trust managers:
• Truststore is empty - no trusted certificates found
• Failed to load truststore as both PEM and KeyStore format. P
• Truststore must not be null for TLS connections

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/a8e69df8bda79a53. Report an issue: GitHub.