testcontainers/testcontainers-java · error · IllegalArgumentException

Elasticsearch CA certificate cannot be empty

Error message

Elasticsearch CA certificate cannot be empty

What it means

Thrown by withElasticsearchCaCertificate when the CA certificate byte array is null or zero-length. In HTTPS-managed mode Kibana needs Elasticsearch's HTTP CA (in PEM format) to trust the Elasticsearch TLS certificate, and an empty array would produce an unusable truststore.

Solutions

1. Pass the actual PEM-encoded HTTP CA bytes from the Elasticsearch container (e.g. elasticsearch.copyFileFromContainer(es.getCertPath(), IOUtils::toByteArray)).
2. Check the CA file on disk is non-empty before reading it.
3. If Elasticsearch is not running HTTPS, remove the CA configuration instead of passing an empty array.

Example fix

// before
byte[] ca = Files.readAllBytes(Path.of(caFile));
container.withElasticsearchCaCertificate(ca);
// after
byte[] ca = Files.readAllBytes(Path.of(caFile));
if (ca.length == 0) throw new IllegalStateException("CA file " + caFile + " is empty");
container.withElasticsearchCaCertificate(ca);

if (caCert == null || caCert.length == 0) throw new IllegalStateException("Elasticsearch HTTP CA must be non-empty PEM bytes");
container.withElasticsearchCaCertificate(caCert);

boolean isValidPem(byte[] cert) { return cert != null && cert.length > 0 && new String(cert, StandardCharsets.US_ASCII).contains("BEGIN CERTIFICATE"); }

try { container.withElasticsearchCaCertificate(ca); } catch (IllegalArgumentException e) { throw new IllegalStateException("CA cert for Elasticsearch is empty — check TLS setup", e); }

When it happens

Trigger: Calling withElasticsearchCaCertificate(null) or withElasticsearchCaCertificate(new byte[0]); also when copying cert bytes from a file/container that failed silently and returned an empty array.

Common situations: Reading the CA file from a path that resolves to an empty file; an earlier copyFileFromContainer call that returned empty bytes; wiring TLS config conditionally and passing an uninitialized byte[].

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Service account token cannot be empty
• Service token cannot have leading or trailing whitespace
• Failed to copy Elasticsearch HTTP CA certificate from
• pathInHomeFolder must not be empty
• Unable to create custom SSL factory instance

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/5fd4865801f89d55. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:255

        }

        if (!token.equals(token.trim())) {
            throw new IllegalArgumentException("Service token cannot have leading or trailing whitespace");
        }
        this.elasticsearchServiceAccountToken = token;
        return this;
    }

    /**
     * Configures the Elasticsearch CA certificate for HTTPS connections.
     *
     * @param caCertificate the CA certificate in PEM format
     * @return this container instance
     * @throws IllegalArgumentException if certificate is empty
     */
    public KibanaContainer withElasticsearchCaCertificate(byte[] caCertificate) {
        if (caCertificate == null || caCertificate.length == 0) {
            throw new IllegalArgumentException("Elasticsearch CA certificate cannot be empty");
        }
        this.elasticsearchCaCertificate = caCertificate;
        return this;
    }

    @Override
    protected void configure() {
        super.configure();

        addEnv("XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY", encryptionKey);
        addEnv("SERVER_NAME", "kibana");

        if (elasticsearchCaCertificate != null) {
            withCopyToContainer(Transferable.of(elasticsearchCaCertificate), ES_CA_CERT_PATH);
            addEnv("ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES", ES_CA_CERT_PATH);
        }
        if (elasticsearch != null) {
            configureManagedElasticsearch();

View on GitHub (pinned to 8e549514e3)