apache/hadoop · error · IOException

Can't create keystore: ${e}

Error message

Can't create keystore: ${e}

What it means

While loading the key store file, KeyStore.getInstance(SCHEME_NAME) (the JCEKS keystore type) or subsequent setup threw a KeyStoreException — the JVM's security provider could not create the keystore object itself. JavaKeyStoreProvider wraps it as IOException("Can't create keystore") with the original cause attached.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:172

      keyStore = KeyStore.getInstance(SCHEME_NAME);
      FsPermission perm = null;
      if (fs.exists(path)) {
        // flush did not proceed to completion
        // _NEW should not exist
        if (fs.exists(newPath)) {
          throw new IOException(
              String.format("Keystore not loaded due to some inconsistency "
              + "('%s' and '%s' should not exist together)!!", path, newPath));
        }
        perm = tryLoadFromPath(path, oldPath);
      } else {
        perm = tryLoadIncompleteFlush(oldPath, newPath);
      }
      // Need to save off permissions in case we need to
      // rewrite the keystore in flush()
      permissions = perm;
    } catch (KeyStoreException e) {
      throw new IOException("Can't create keystore: " + e, e);
    } catch (GeneralSecurityException e) {
      throw new IOException("Can't load keystore " + path + " : " + e , e);
    }
  }

  /**
   * Try loading from the user specified path, else load from the backup
   * path in case Exception is not due to bad/wrong password.
   * @param path Actual path to load from
   * @param backupPath Backup path (_OLD)
   * @return The permissions of the loaded file
   * @throws NoSuchAlgorithmException
   * @throws CertificateException
   * @throws IOException
   */
  private FsPermission tryLoadFromPath(Path path, Path backupPath)
      throws NoSuchAlgorithmException, CertificateException,
      IOException {

View on GitHub (pinned to 2add963021)

Solutions

1. Run KMS on a fully supported JDK distribution (e.g. Adoptium/OpenJDK) — do not use cut-down JRE builds
2. Inspect $JAVA_HOME/conf/security/java.security and confirm the SunJCE provider is registered
3. Verify the JVM can create the keystore type: keytool -list on any jceks file, or a one-line KeyStore.getInstance("jceks") smoke test
4. Check the nested cause in the log for the exact provider error

// Smoke-test the JVM can create a JCEKS keystore before starting KMS
try {
  java.security.KeyStore.getInstance("jceks");
} catch (java.security.KeyStoreException e) {
  throw new IllegalStateException("JVM cannot create JCEKS keystores: " + e); 
}

try {
  provider = new JavaKeyStoreProvider(uri, conf);
} catch (IOException e) {
  LOG.error("Keystore init failed on this JVM: {}", e.getMessage(), e.getCause());
  // inspect cause for KeyStoreException -> JDK/provider problem, not data problem
}

When it happens

Trigger: The JCE security provider cannot instantiate a 'jceks' KeyStore — e.g. a broken/limited JDK runtime, a security provider misconfiguration, or a JDK that does not expose the JCEKS type. Distinguished from load failures (wrong password/corrupt file), which surface as GeneralSecurityException instead.

Common situations: Running KMS on an unsupported or stripped-down JRE; custom java.security files that removed the SunJCE provider; JDK upgrades or vendor JDKs with provider differences

Related errors

• Can't get algorithm for key ${key} from ${path}
• Can't get algorithm for ${name} from keystore ${path}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't load keystore ${path} : ${e}
• Can't get key ${versionName} from ${path}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/820fe1100d16a646. Report an issue: GitHub.