apache/hadoop · critical · IOException

Can't create keystore

Error message

Can't create keystore

What it means

In locateKeystore(), KeyStore.getInstance(...) for the provider's store type threw KeyStoreException, wrapped as 'Can't create keystore': the JVM has no security provider able to supply that keystore implementation (Hadoop's file providers use type 'jceks'). The store file was never even opened - this is a JVM capability failure.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java:335

          conf.get(CREDENTIAL_PASSWORD_FILE_KEY));
      if (password == null) {
        password = CREDENTIAL_PASSWORD_DEFAULT.toCharArray();
      }
      KeyStore ks;
      ks = KeyStore.getInstance(getKeyStoreType());
      if (keystoreExists()) {
        stashOriginalFilePermissions();
        try (InputStream in = getInputStreamForFile()) {
          ks.load(in, password);
        }
      } else {
        createPermissions("600");
        // required to create an empty keystore. *sigh*
        ks.load(null, password);
      }
      keyStore = ks;
    } catch (KeyStoreException e) {
      throw new IOException("Can't create keystore", e);
    } catch (GeneralSecurityException e) {
      throw new IOException("Can't load keystore " + getPathAsString(), e);
    }
  }

  @Override
  public boolean needsPassword() throws IOException {
    return (null == ProviderUtils.locatePassword(CREDENTIAL_PASSWORD_ENV_VAR,
        conf.get(CREDENTIAL_PASSWORD_FILE_KEY)));

  }

  @Override
  public String noPasswordWarning() {
    return ProviderUtils.noPasswordWarning(CREDENTIAL_PASSWORD_ENV_VAR,
            CREDENTIAL_PASSWORD_FILE_KEY);
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Use a full standard JDK and confirm SunJCE is listed: keytool -help should succeed; or print Security.getProviders()
2. Review $JAVA_HOME/lib/security/java.security (or java.security.properties overrides) and restore/remove overrides that strip providers
3. On FIPS JVMs, add a provider that implements the JCEKS store type before Hadoop starts

// Fail fast with a clear message if this JVM cannot open JCEKS stores at all
try {
  KeyStore.getInstance("jceks");
} catch (java.security.KeyStoreException e) {
  throw new IllegalStateException(
      "No JCEKS KeyStore implementation in this JVM - check java.security providers", e);
}

try {
  List<CredentialProvider> ps = CredentialProviderFactory.getProviders(conf);
} catch (IOException ex) {
  if (ex.getMessage() != null && ex.getMessage().contains("Can't create keystore")) {
    // JVM capability problem: switch to a full JDK / fix provider list; not retryable
  } else { throw ex; }
}

When it happens

Trigger: Constructing a jceks/localjceks provider on a JVM where the JCEKS KeyStore implementation is unavailable or disabled (FIPS/NSS-only JVM, stripped JRE, custom java.security with SunJCE removed); keystore.type overrides that break provider resolution.

Common situations: Hardened FIPS environments; minimal container JREs; java.security tampering; running the shell on an unsupported Java vendor.

Related errors

• Can't get credential " + alias + " from " + getPathAsString(
• Can't get algorithm for credential " + alias + " from " + ge
• Can't recover credential " + alias + " from " + getPathAsStr
• Can't get alias " + alias + " from " + getPathAsString()
• Credential " + alias + " already exists in " + this

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/4a25ffd216e8b950. Report an issue: GitHub.