prestodb/presto · error · PrestoException

PROMETHEUS_SECURE_COMMUNICATION_ERROR

PROMETHEUS_SECURE_COMMUNICATION_ERROR

Error message

An SSL handshake error occurred while establishing a secure connection. Try the following measures to resolve the error:

- Upload a valid SSL certificate for authentication
- Verify the expiration status of the uploaded certificate.
- If you are connecting with SSL, enable SSL on both ends of the connection.

What it means

The Prometheus connector's fetchUri catches SSLHandshakeException while reading the Prometheus HTTP API response and rethrows it as a PrestoException with code PROMETHEUS_SECURE_COMMUNICATION_ERROR. It means the TLS handshake with the Prometheus server failed — the connection could not be secured before any data was exchanged. This is thrown only when SSL/TLS is in play; plain-HTTP IO failures take a different path.

Source

Thrown at presto-prometheus/src/main/java/com/facebook/presto/plugin/prometheus/PrometheusClient.java:194

                else {
                    httpClient = new OkHttpClient.Builder()
                            .sslSocketFactory(getSSLContext().getSocketFactory(), (X509TrustManager) getTrustManagerFactory().getTrustManagers()[0])
                            .build();
                }
                response = httpClient.newCall(requestBuilder.build()).execute();
                if (response.isSuccessful() && response.body() != null) {
                    return response.body().bytes();
                }
            }
            else {
                response = httpClient.newCall(requestBuilder.build()).execute();
                if (response.isSuccessful() && response.body() != null) {
                    return response.body().bytes();
                }
            }
        }
        catch (SSLHandshakeException e) {
            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, "An SSL handshake error occurred while establishing a secure connection. Try the following measures to resolve the error:\n\n" + "- Upload a valid SSL certificate for authentication\n- Verify the expiration status of the uploaded certificate.\n- If you are connecting with SSL, enable SSL on both ends of the connection.\n", e);
        }
        catch (SSLPeerUnverifiedException e) {
            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, "Peer verification failed. These measures might resolve the issue \n" +
                    "- Add correct Hostname in the SSL certificate's SAN list \n" +
                    "- The certificate chain might be incomplete. Check your SSL certificate\n", e);
        }
        catch (IOException e) {
            throw new PrestoException(PROMETHEUS_UNKNOWN_ERROR, "Error reading metrics", e);
        }
        catch (NoSuchAlgorithmException e) {
            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, "Requested cryptographic algorithm is not available", e);
        }
        catch (KeyStoreException e) {
            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, "Keystore operation error", e);
        }
        catch (KeyManagementException e) {
            throw new PrestoException(PROMETHEUS_SECURE_COMMUNICATION_ERROR, "Key management operation error", e);
        }

View on GitHub (pinned to 55bb57d202)

Solutions

Verify the Prometheus server's certificate with a browser or `openssl s_client -connect host:port -servername host` and renew it if expired
If using a custom truststore, add the server's CA certificate to it (keytool -importcert) and point presto-prometheus.properties prometheus.trust-certificate at it
Ensure SSL is enabled on both ends — the connector's URI scheme (https) must match the server's actual TLS configuration
Import the corporate CA into the JVM cacerts used by the Presto coordinator if TLS interception is in play

Example fix

// before (self-signed cert rejected)
connection-url=https://prometheus.example.com:9090
// after: provide truststore config
prometheus.trust-certificate=/etc/presto/prometheus.truststore
prometheus.truststore.password=changeit

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify TLS reachability and cert validity before configuring
openssl s_client -connect prometheus.example.com:9090 -servername prometheus.example.com 2>/dev/null | openssl x509 -noout -dates -subject

Try / catch

try { result = queryPrometheus(); } catch (PrestoException e) {
  if (PROMETHEUS_SECURE_COMMUNICATION_ERROR.equals(e.getErrorCode().getName())) {
    // inspect certificate/truststore, then retry after fix
  } else throw e;
}

Prevention

Always use a CA-signed certificate with valid SANs on the Prometheus endpoint
Keep prometheus.trust-certificate in sync with the server's CA and renew before expiry
Test https reachability with curl/openssl whenever the connection-url changes
Enable SSL on both ends — match the URI scheme to the server's TLS config

When it happens

Trigger: Calling fetchUri (via fetchMetrics or PrometheusRecordSet) against an https:// Prometheus URI when the server's certificate is expired, self-signed, untrusted by the JVM truststore, or the server does not actually support SSL on that port.

Common situations: Prometheus fronted by a proxy/load balancer with an expired or self-signed cert; TLS enabled on the client but plain HTTP on the server port (or vice versa); corporate proxy doing TLS interception; JVMcacerts missing the private CA.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/7718d387c7d59794. Report an issue: GitHub.