t8y2/dbx · error

JKS truststore contains no certificates

Error message

JKS truststore contains no certificates

What it means

loadTrustStore parses a Java KeyStore (JKS) truststore file into a list of x509 certificates for TLS. After iterating all entries, if no certificate could be extracted, it returns this error because an empty truststore cannot validate any server certificate. It is thrown by buildTLSConfig/buildZooKeeperTLSConfig when configuring a ZooKeeper TLS connection.

Source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:111

					return nil, parseErr
				}
				certificates = append(certificates, certificate)
			case store.IsPrivateKeyEntry(alias):
				chain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)
				if getErr != nil {
					return nil, getErr
				}
				for _, entry := range chain {
					certificate, parseErr := x509.ParseCertificate(entry.Content)
					if parseErr != nil {
						return nil, parseErr
					}
					certificates = append(certificates, certificate)
				}
			}
		}
		if len(certificates) == 0 {
			return nil, errors.New("JKS truststore contains no certificates")
		}
		return certificates, nil
	default:
		return nil, fmt.Errorf("unsupported store type %q", storeType)
	}
}

func loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return tls.Certificate{}, err
	}
	switch normalizedStoreType(storeType, path) {
	case "PEM":
		return tls.X509KeyPair(contents, contents)
	case "PKCS12":
		privateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)
		if err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

  1. Import the CA/server certificate into the truststore: keytool -importcert -alias ca -file ca.pem -keystore truststore.jks
  2. Verify you are pointing at the truststore file, not the client keystore file
  3. Check the truststore password is correct so entries can be read
  4. If you only have PEM certs, use the PEM truststore format instead of JKS

Example fix

// before: empty truststore
# keytool -genkeypair -keystore truststore.jks  // wrong: truststores hold certs
// after
# keytool -importcert -alias zk-ca -file ca.crt -keystore truststore.jks -storepass changeit -noprompt
Defensive patterns

Strategy: validation

Validate before calling

// check the JKS truststore has at least one cert before wiring TLS
out, _ := exec.Command("keytool", "-list", "-keystore", truststorePath,
    "-storepass", password).Output()
if !strings.Contains(string(out), "trustedCertEntry") {
    return fmt.Errorf("truststore %s has no certificates", truststorePath)
}

Try / catch

if err != nil && strings.Contains(err.Error(), "JKS truststore contains no certificates") {
    // fail fast with actionable config guidance
}

Prevention

When it happens

Trigger: Calling buildZooKeeperTLSConfig/buildTLSConfig with a truststore whose path/type resolves to a JKS file that contains zero certificate entries (only key entries, only metadata entries, or a freshly created empty JKS).

Common situations: Pointing trustStorePath at a keystore instead of a truststore; a keytool-generated truststore that never had 'keytool -importcert' run; wrong password causing entries to be skipped silently; a JKS created empty and never populated in CI.

Understand the failure class

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/12c70951923a40b4. Report an issue: GitHub.