prestodb/presto · error · GeneralSecurityException

Truststore is empty - no trusted certificates found

Error message

Truststore is empty - no trusted certificates found

What it means

createTrustManager defensively validates that a loaded KeyStore actually contains at least one certificate alias before handing it to the TrustManagerFactory. An empty truststore would silently trust nothing (or fail later), so the provider throws GeneralSecurityException('Truststore is empty - no trusted certificates found') early.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:184

    {
        char[] keyManagerPassword = keystorePassword.map(String::toCharArray).orElse(null);
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(getDefaultAlgorithm());
        keyManagerFactory.init(keystore, keyManagerPassword);
        return keyManagerFactory.getKeyManagers();
    }

    private X509TrustManager createTrustManager(KeyStore truststore) throws GeneralSecurityException
    {
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(getDefaultAlgorithm());

        // When truststore is null, TrustManagerFactory will use JVM's system default truststore
        // When truststore is not null, validate it contains certificates before using it
        if (truststore != null) {
            try {
                // Check if truststore has any certificates
                List<String> aliases = Collections.list(truststore.aliases());
                if (aliases.isEmpty()) {
                    throw new GeneralSecurityException("Truststore is empty - no trusted certificates found");
                }
                log.debug("Truststore contains {} certificate(s): {}", aliases.size(), aliases);
            }
            catch (KeyStoreException e) {
                throw new GeneralSecurityException("Failed to read truststore", e);
            }
        }

        trustManagerFactory.init(truststore);

        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException("Unexpected default trust managers: " + Arrays.toString(trustManagers));
        }

        return (X509TrustManager) trustManagers[0];
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check the truststore file contents (keytool -list -v -keystore truststore.jks or openssl on the PEM) and confirm it has certificates
2. Re-export/import the CA certificates into the truststore (keytool -importcert)
3. Fix the secret/volume mount so the real truststore file is present at the configured path
4. Verify the password — a wrong password can result in an empty store rather than an error

Example fix

// verify before deploy
keytool -list -v -keystore /etc/presto/truststore.jks -storepass $TS_PASS
// expect: 'Your keystore contains N entries' with N >= 1

# ensure the truststore actually contains certificates before use
keytool -list -keystore truststore.jks -storepass $TS_PASS | grep -q 'Your keystore contains [1-9]' || echo EMPTY

When it happens

Trigger: createTrustManager (via trustManager) receives a non-null truststore whose Collections.list(truststore.aliases()) is empty — the file loaded successfully but held no certificate entries, e.g. an empty file or wrong password creating a fresh empty store.

Common situations: Mounting an empty placeholder file at the truststore path in Kubernetes; wrong password causing some loaders to yield an empty store; a PEM file containing only a private key with no certificates; truncated file after a bad secret update.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unexpected default trust managers:
• Expected exactly one X509TrustManager, but found: ${trustMan
• GENERIC_INTERNAL_ERROR
• Failed to read truststore
• Failed to load truststore as both PEM and KeyStore format. P

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/d68fffcdf13e78b3. Report an issue: GitHub.