prestodb/presto · error · PrestoException

GENERIC_INTERNAL_ERROR

GENERIC_INTERNAL_ERROR

Error message

At least one of iceberg.rest.tls.keystore-path or iceberg.rest.tls.truststore-path must be configured when iceberg.rest.tls.enabled is true

What it means

PrestoRestTLSConfigurer.initialize validates TLS configuration for the Iceberg REST catalog. When iceberg.rest.tls.enabled=true, at least one of keystore-path (client identity for mTLS) or truststore-path (server cert verification) must be present; otherwise the TLS layer cannot be built. It throws PrestoException with code GENERIC_INTERNAL_ERROR.

Source

Thrown at presto-iceberg/src/main/java/com/facebook/presto/iceberg/rest/PrestoRestTLSConfigurer.java:58

public class PrestoRestTLSConfigurer
        implements TLSConfigurer
{
    static final String TLS_CONFIGURER_IMPL = "rest.client.tls.configurer-impl";
    static final String KEYSTORE_PATH = "rest.client.tls.keystore-path";
    static final String KEYSTORE_PASSWORD = "rest.client.tls.keystore-password";
    static final String TRUSTSTORE_PATH = "rest.client.tls.truststore-path";
    static final String TRUSTSTORE_PASSWORD = "rest.client.tls.truststore-password";

    private SSLContext sslContext;

    @Override
    public void initialize(Map<String, String> properties)
    {
        String keystorePath = properties.get(KEYSTORE_PATH);
        String truststorePath = properties.get(TRUSTSTORE_PATH);

        if (keystorePath == null && truststorePath == null) {
            throw new PrestoException(GENERIC_INTERNAL_ERROR,
                    "At least one of iceberg.rest.tls.keystore-path or iceberg.rest.tls.truststore-path " +
                            "must be configured when iceberg.rest.tls.enabled is true");
        }

        SslContextProvider sslContextProvider = new SslContextProvider(
                Optional.ofNullable(keystorePath).map(File::new),
                Optional.ofNullable(properties.get(KEYSTORE_PASSWORD)),
                Optional.ofNullable(truststorePath).map(File::new),
                Optional.ofNullable(properties.get(TRUSTSTORE_PASSWORD)));

        this.sslContext = sslContextProvider.buildSslContext()
                .orElseThrow(() -> new PrestoException(GENERIC_INTERNAL_ERROR,
                        "Failed to build SSL context for REST catalog TLS communication"));
    }

    @Override
    public SSLContext sslContext()
    {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Set either iceberg.rest.tls.keystore-path or iceberg.rest.tls.truststore-path (or both for mTLS) in the catalog properties when iceberg.rest.tls.enabled=true
2. Verify property names are spelled exactly (iceberg.rest.tls.keystore-path, iceberg.rest.tls.truststore-path)
3. If TLS is not actually required, set iceberg.rest.tls.enabled=false instead

Example fix

// before
iceberg.rest.tls.enabled=true
iceberg.rest.tls.keystore-password=secret
// after
iceberg.rest.tls.enabled=true
iceberg.rest.tls.keystore-path=/etc/presto/tls/client.keystore
iceberg.rest.tls.truststore-path=/etc/presto/tls/truststore
iceberg.rest.tls.keystore-password=secret

if (Boolean.parseBoolean(props.getProperty("iceberg.rest.tls.enabled"))
        && props.getProperty("iceberg.rest.tls.keystore-path") == null
        && props.getProperty("iceberg.rest.tls.truststore-path") == null) {
    throw new IllegalArgumentException(
        "iceberg.rest.tls.enabled=true requires iceberg.rest.tls.keystore-path or iceberg.rest.tls.truststore-path");
}

try { tlsConfigurer.initialize(properties); }
catch (PrestoException e) {
    if (e.getErrorCode().getCode() == GENERIC_INTERNAL_ERROR.toErrorCode().getCode()) {
        log.error("TLS enabled but no keystore/truststore path set; fix catalog properties", e);
    }
    throw e;
}

When it happens

Trigger: Calling initialize() with a config map where iceberg.rest.tls.enabled=true but both iceberg.rest.tls.keystore-path and iceberg.rest.tls.truststore-path are absent (e.g. only passwords set, as in testInitializeWithPasswordOnlyThrows).

Common situations: Operators enable TLS for the REST catalog but forget to copy the keystore/truststore path properties into the catalog properties file; partial migration from a non-TLS catalog config; typos in property names so both lookups return null.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Error setting up SSL:
• Unexpected default trust managers:
• GENERIC_INTERNAL_ERROR
• Truststore must not be null for TLS connections
• ACCUMULO_TABLE_EXISTS

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/eb08b036820275a1. Report an issue: GitHub.