prestodb/presto · error · RuntimeException

Unexpected default trust managers:

Error message

Unexpected default trust managers:

What it means

setupSsl initializes a TrustManagerFactory from the configured trust store and expects the default algorithm to yield exactly one TrustManager of type X509TrustManager. If the JDK's default trust management produces zero, multiple, or non-X509 managers, this RuntimeException is thrown, since the HTTPS client can only work with a single X509TrustManager. It indicates the trust store type or JVM security providers are producing an unsupported TrustManager layout.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/OkHttpUtil.java:233

                keyManagerFactory.init(keyStore, keyManagerPassword);
                keyManagers = keyManagerFactory.getKeyManagers();
            }

            // load TrustStore if configured, otherwise use KeyStore
            KeyStore trustStore = keyStore;
            if (trustStorePath.isPresent()) {
                checkArgument(trustStoreType.isPresent(), "truststore type is not present");
                trustStore = loadTrustStore(Paths.get(trustStorePath.get()).toFile(), trustStorePassword, trustStoreType.get());
            }

            // create TrustManagerFactory
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(trustStore);

            // get X509TrustManager
            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
            if ((trustManagers.length != 1) || !(trustManagers[0] instanceof X509TrustManager)) {
                throw new RuntimeException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
            }
            X509TrustManager trustManager = (X509TrustManager) trustManagers[0];

            // create SSLContext
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(keyManagers, new TrustManager[] {trustManager}, null);

            clientBuilder.sslSocketFactory(sslContext.getSocketFactory(), trustManager);
            clientBuilder.hostnameVerifier(LegacyHostnameVerifier.INSTANCE);
        }
        catch (GeneralSecurityException | IOException e) {
            throw new ClientException("Error setting up SSL: " + e.getMessage(), e);
        }
    }

    private static void validateCertificates(KeyStore keyStore)
            throws GeneralSecurityException
    {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Use the standard trust store types JKS or PKCS12 for --truststore-type / trustStoreType.
2. Check the JVM's security providers (java.security file, installed providers) for overrides of TrustManagerFactory.
3. Test with a different JDK to rule out vendor-specific default trust manager behavior.
4. If a custom provider is required, ensure its TrustManagerFactory returns exactly one X509TrustManager.

Example fix

// before
--truststore-type=PKCS11
// after
--truststore-type=JKS

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(trustStore);
TrustManager[] tms = tmf.getTrustManagers();
if (tms.length != 1 || !(tms[0] instanceof X509TrustManager)) {
    throw new IllegalStateException("Trust store yields non-X509 trust managers; use JKS/PKCS12");
}

try { setupSsl(...); } catch (RuntimeException e) { if (e.getMessage().startsWith("Unexpected default trust managers")) { /* switch store type/provider */ } else { throw e; } }

When it happens

Trigger: Calling setupSsl (via setupSslHttpConfig/buildClient) with a trust store whose type/provider causes TrustManagerFactory.getTrustManagers() to return an array whose length != 1 or whose first element is not an X509TrustManager.

Common situations: Using an exotic trustStoreType (e.g. PKCS11 or a custom provider) registered in java.security; a JDK with non-standard security providers; a corrupted or unusual KeyStore implementation that returns composite trust managers.

Related errors

• Error setting up SSL:
• Unexpected default trust managers:
• Expected exactly one X509TrustManager, but found: ${trustMan
• Truststore is empty - no trusted certificates found
• Failed to read truststore

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/ed60f266b73e1962. Report an issue: GitHub.