apache/hadoop · error · IOException

Can't get algorithm for ${name} from keystore ${path}

Error message

Can't get algorithm for ${name} from keystore ${path}

What it means

In getMetadata(), getKey() threw NoSuchAlgorithmException: the algorithm protecting the metadata entry in the keystore is unavailable in the current JVM's JCE providers. The message names the key and keystore path.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:422

      if (cache.containsKey(name)) {
        return cache.get(name);
      }
      try {
        if (!keyStore.containsAlias(name)) {
          return null;
        }
        Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata;
        cache.put(name, meta);
        return meta;
      } catch (ClassCastException e) {
        throw new IOException("Can't cast key for " + name + " in keystore " +
            path + " to a KeyMetadata. Key may have been added using " +
            " keytool or some other non-Hadoop method.", e);
      } catch (KeyStoreException e) {
        throw new IOException("Can't get metadata for " + name +
            " from keystore " + path, e);
      } catch (NoSuchAlgorithmException e) {
        throw new IOException("Can't get algorithm for " + name +
            " from keystore " + path, e);
      } catch (UnrecoverableKeyException e) {
        throw new IOException("Can't recover key for " + name +
            " from keystore " + path, e);
      }
    } finally {
      readLock.unlock();
    }
  }

  @Override
  public KeyVersion createKey(String name, byte[] material,
                               Options options) throws IOException {
    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),
        "Uppercase key names are unsupported: %s", name);
    writeLock.lock();
    try {
      try {

View on GitHub (pinned to 2add963021)

Solutions

1. Run KMS on a current JDK (8u161+ or 11+) where unlimited-strength JCE is default
2. Recreate or re-save the keystore under the target JDK so entries use available protection algorithms
3. Inspect the nested cause for the missing algorithm name and verify the SunJCE provider is active

// Confirm the JVM can read every entry before going live
KeyStore ks = KeyStore.getInstance("jceks");
ks.load(in, pwd);
for (Enumeration<String> a = ks.aliases(); a.hasMoreElements();) {
  ks.getKey(a.nextElement(), pwd); // surfaces unavailable algorithms now
}

try {
  meta = provider.getMetadata(name);
} catch (IOException e) {
  if (e.getCause() instanceof NoSuchAlgorithmException) {
    // JDK lacks the protection algorithm: upgrade JDK and re-save the keystore
  }
}

When it happens

Trigger: Metadata lookup on a keystore whose entries were protected with an algorithm the runtime JDK lacks — keystore written under a different JDK/vendor, or a restricted-JCE runtime reading stronger protection algorithms.

Common situations: JDK downgrades or vendor swaps on KMS hosts; very old Java 8 builds before unlimited-strength defaults; keystores produced by other tools with non-default entry protection

Related errors

• Can't get algorithm for key ${key} from ${path}
• Can't create keystore: ${e}
• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't load keystore ${path} : ${e}
• Can't get key ${versionName} from ${path}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/8579896f3a7cc7e7. Report an issue: GitHub.