t8y2/dbx · error · RuntimeException

Failed to configure TLS: ${e.getMessage()}

Error message

Failed to configure TLS: ${e.getMessage()}

What it means

Thrown by MongoAgent.applyTlsSettings while enabling TLS on the MongoClientSettings builder — typically when loading/parsing the CA certificate or client certificate/key files referenced by the TLS connection parameters. The underlying exception message (e.getMessage()) is embedded; the failure means the driver could not build the SSL context, so client construction aborts.

Source

Thrown at agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java:172

        return client;
    }

    private static Object connect(JsonObject params) {
        closeLegacyClient();
        legacyClient = openClient(params);
        return Collections.singletonMap("ok", true);
    }

    private static void applyTlsSettings(MongoClientSettings.Builder builder,
        String caCertPath, String clientCertPath, String clientKeyPath) {
        builder.applyToSslSettings(sslBuilder -> {
            sslBuilder.enabled(true);
            if (caCertPath != null && !caCertPath.isBlank()
                || clientCertPath != null && !clientCertPath.isBlank()) {
                try {
                    sslBuilder.context(createTlsSslContext(caCertPath, clientCertPath, clientKeyPath));
                } catch (Exception e) {
                    throw new RuntimeException("Failed to configure TLS: " + e.getMessage(), e);
                }
            }
        });
    }

    static SSLContext createTlsSslContext(String caCertPath, String clientCertPath, String clientKeyPath)
        throws Exception {
        TrustManager[] trustManagers = null;
        if (caCertPath != null && !caCertPath.isBlank()) {
            trustManagers = loadTrustManagersFromPem(caCertPath);
        }

        KeyManager[] keyManagers = null;
        if (clientCertPath != null && !clientCertPath.isBlank()
            && clientKeyPath != null && !clientKeyPath.isBlank()) {
            keyManagers = loadKeyManagersFromPem(clientCertPath, clientKeyPath);
        }

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the embedded cause message: file-not-found usually means the ca/client certificate paths are wrong on the agent host
2. Verify certificate and key files are valid PEM and readable by the agent process
3. For client certificates confirm the key is PKCS#8 or PKCS#1 PEM as required by loadPrivateKeyFromPem
4. If TLS is not actually required, remove the TLS-related connection parameters

When it happens

Trigger: Thrown at agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java:172 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/1f05af2d2c0e3901. Report an issue: GitHub.