prestodb/presto · error · RuntimeException

Unexpected default trust managers:

Error message

Unexpected default trust managers: 

What it means

After initializing the TrustManagerFactory, createTrustManager expects exactly one X509TrustManager. If the JVM returns zero, multiple, or non-X.509 trust managers, it throws RuntimeException('Unexpected default trust managers: ' + Arrays.toString(...)). This guards against unusual security providers returning unsupported manager types.

Source

Thrown at presto-plugin-toolkit/src/main/java/com/facebook/presto/plugin/base/security/SslContextProvider.java:197

        if (truststore != null) {
            try {
                // Check if truststore has any certificates
                List<String> aliases = Collections.list(truststore.aliases());
                if (aliases.isEmpty()) {
                    throw new GeneralSecurityException("Truststore is empty - no trusted certificates found");
                }
                log.debug("Truststore contains {} certificate(s): {}", aliases.size(), aliases);
            }
            catch (KeyStoreException e) {
                throw new GeneralSecurityException("Failed to read truststore", e);
            }
        }

        trustManagerFactory.init(truststore);

        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
            throw new RuntimeException("Unexpected default trust managers: " + Arrays.toString(trustManagers));
        }

        return (X509TrustManager) trustManagers[0];
    }

    private static KeyStore loadTrustStore(File trustStorePath, Optional<String> trustStorePassword)
            throws GeneralSecurityException
    {
        KeyStore trustStore = getInstance(getDefaultType());
        boolean loaded = false;
        Exception lastException = null;

        // First try to load as PEM format
        try {
            log.debug("Attempting to load truststore as PEM format");
            List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);
            if (!certificateChain.isEmpty()) {
                trustStore.load(null, null);

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check the printed manager list in the message to see what type was returned
2. Remove or disable custom security providers in java.security that alter default trust manager behavior
3. Ensure the truststore uses a standard X.509-compatible type (JKS/PKCS12)
4. Run on a standard JDK (Temurin/OpenJDK) instead of a FIPS or vendor-special build

Example fix

// before (java.security)
security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider
// after
# remove/deprioritize the custom provider altering TrustManagerFactory defaults
security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider

# detect providers that may change TrustManagerFactory behavior
grep -v '^#' $JAVA_HOME/conf/security/java.security | grep security.provider

try {
    SSLContext ctx = provider.sslContext(...);
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Unexpected default trust managers")) {
        log.error("JVM returned non-X509 trust managers; check security providers", e);
    }
    throw e;
}

When it happens

Trigger: trustManagerFactory.getTrustManagers() (inside createTrustManager, via trustManager) returns an array of length != 1 or whose element is not an X509TrustManager — typically because a custom JCE/security provider or exotic truststore type produced different manager types.

Common situations: Installing a custom security provider (e.g. FIPS provider) on the Presto JVM; a non-X.509 KeyStore type configured for the truststore; unusual JDK builds with extra default trust managers.

Related errors

• GENERIC_INTERNAL_ERROR
• Truststore is empty - no trusted certificates found
• Failed to read truststore
• Failed to load truststore as both PEM and KeyStore format. P
• INVALID_TABLE_PROPERTY

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/10c85793e00fa196. Report an issue: GitHub.