prestodb/presto · error · IllegalStateException

Truststore must not be null for TLS connections

Error message

Truststore must not be null for TLS connections

What it means

RedisJedisManager.createSslContext initializes a TrustManagerFactory from a KeyStore to build the TLS SSLContext for TLS Redis connections. If the truststore KeyStore is null it cannot be initialized, so an IllegalStateException is thrown immediately. TLS connections always require a truststore to validate the Redis server certificate.

Source

Thrown at presto-redis/src/main/java/com/facebook/presto/redis/RedisJedisManager.java:121

    {
        boolean isTlsEnabled = redisConnectorConfig.isTlsEnabled();
        SSLContext sslContext = null;

        if (isTlsEnabled) {
            KeyStore trustStore = loadTrustStore();
            sslContext = createSslContext(trustStore);
        }

        return buildJedisPool(host, isTlsEnabled, sslContext);
    }

    /**
     * Creates SSLContext initialized with the given truststore.
     */
    private SSLContext createSslContext(KeyStore trustStore)
    {
        if (trustStore == null) {
            throw new IllegalStateException("Truststore must not be null for TLS connections");
        }

        try {
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(getDefaultAlgorithm());
            tmf.init(trustStore);

            SSLContext sslContext = SSLContext.getInstance(TLS_PROTOCOL);
            sslContext.init(null, tmf.getTrustManagers(), null);

            return sslContext;
        }
        catch (NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) {
            throw new RuntimeException("Failed to initialize SSLContext", e);
        }
    }

    private JedisPoolConfig createJedisPoolConfig()
    {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Set redis.truststore-path (redis.truststore-password if needed) to a valid truststore containing the Redis server cert
2. Disable TLS (redis.tls-enabled=false) if secure connections are not actually required
3. Verify the connector config is loaded and the path property name is spelled correctly

Example fix

// before
redis.tls-enabled=true
// after
redis.tls-enabled=true
redis.truststore-path=/etc/presto/redis/truststore.jks

if (tlsEnabled && (truststorePath == null || truststorePath.isEmpty())) {
    throw new IllegalArgumentException("truststore-path is required when tls-enabled=true");
}

try { createSslContext(trustStore); } catch (IllegalStateException e) { log.error("TLS configured without truststore: " + e.getMessage()); throw e; }

When it happens

Trigger: redis.truststore-path is not configured (null) while redis.tls-enabled=true; the config that loads the truststore returns null before createSslContext is invoked via createJedisPool.

Common situations: Enabling TLS on the Redis connector without setting the truststore path property; environment where the config file was not updated after turning on TLS; programmatic connector config missing setTruststorePath.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Error setting up SSL:
• Unexpected default trust managers:
• GENERIC_INTERNAL_ERROR
• Failed to initialize SSLContext
• Failed to load truststore

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8dad6760bd176ef5. Report an issue: GitHub.