apache/hadoop · error · IOException

Can't load keystore ${path} : ${e}

Error message

Can't load keystore ${path} : ${e}

What it means

Loading the keystore file content threw a GeneralSecurityException (wrong password, unsupported algorithm while reading entries, or a malformed/unrecognized keystore file). The message includes the keystore path and the underlying exception.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:174

      if (fs.exists(path)) {
        // flush did not proceed to completion
        // _NEW should not exist
        if (fs.exists(newPath)) {
          throw new IOException(
              String.format("Keystore not loaded due to some inconsistency "
              + "('%s' and '%s' should not exist together)!!", path, newPath));
        }
        perm = tryLoadFromPath(path, oldPath);
      } else {
        perm = tryLoadIncompleteFlush(oldPath, newPath);
      }
      // Need to save off permissions in case we need to
      // rewrite the keystore in flush()
      permissions = perm;
    } catch (KeyStoreException e) {
      throw new IOException("Can't create keystore: " + e, e);
    } catch (GeneralSecurityException e) {
      throw new IOException("Can't load keystore " + path + " : " + e , e);
    }
  }

  /**
   * Try loading from the user specified path, else load from the backup
   * path in case Exception is not due to bad/wrong password.
   * @param path Actual path to load from
   * @param backupPath Backup path (_OLD)
   * @return The permissions of the loaded file
   * @throws NoSuchAlgorithmException
   * @throws CertificateException
   * @throws IOException
   */
  private FsPermission tryLoadFromPath(Path path, Path backupPath)
      throws NoSuchAlgorithmException, CertificateException,
      IOException {
    FsPermission perm = null;
    try {

View on GitHub (pinned to 2add963021)

Solutions

1. Check the password first: confirm the password file referenced by KEYSTORE_PASSWORD_FILE_KEY matches what keytool -list -keystore <path> -storetype jceks accepts
2. Verify integrity: keytool -list on the file; if unreadable, restore from the <path>_OLD backup or backups
3. Confirm the file is JCEKS and not another format — regenerate if the format was changed by keytool conversions
4. Read the nested cause in the KMS log — 'Given final block not properly padded' or 'keystore password was incorrect' points to password; 'Invalid keystore format' points to corruption

Example fix

# before: KMS log shows Can't load keystore /etc/security/keys/ks.jks

# after: verify password and format
keytool -list -keystore /etc/security/keys/ks.jks -storetype jceks \
  -storepass:file /etc/security/keys/ks.password
# if wrong password -> fix the password file referenced by
#   hadoop.security.keystore.java.key.password... / KEYSTORE_PASSWORD_FILE_KEY

// Verify the keystore loads with the intended password before KMS start
char[] pwd = readFileTrimmed(passwordFile).toCharArray();
KeyStore ks = KeyStore.getInstance("jceks");
try (InputStream in = Files.newInputStream(keystorePath)) {
  ks.load(in, pwd);
}

try {
  provider.getKeys(); // forces load
} catch (IOException e) {
  Throwable c = e.getCause();
  if (c instanceof GeneralSecurityException) {
    // password or format problem: fix password file or restore keystore
  }
}

When it happens

Trigger: tryLoadFromPath/tryLoadIncompleteFlush call keyStore.load() and it fails: the stored password does not match the one supplied via KEYSTORE_PASSWORD_FILE_KEY (or the default), the file is corrupt, or the file is not actually a JCEKS keystore.

Common situations: Password file (hadoop.security.credential.provider.path keystore password file) out of sync with the keystore; keystore truncated by a disk issue; someone replaced the file with a PKCS12 keystore; JDK version change altering default keystore handling

Related errors

• Keystore not loaded due to some inconsistency ('%s' and '%s'
• Can't recover key ${key} from ${path}
• Can't recover key for ${name} from keystore ${path}
• Can't create keystore: ${e}
• Can't get key ${versionName} from ${path}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/4968b52bc107648f. Report an issue: GitHub.