apache/hadoop · error · IOException

Can't store key ${versionName} in ${this}

Error message

Can't store key ${versionName} in ${this}

What it means

innerSetKeyVersion is the single path through which createKey and rollNewVersion write a SecretKeySpec into the JCEKS keystore via KeyStore.setKeyEntry; the wrapped KeyStoreException 'Can't store key <name>@N in <uri>' means the keystore refused the entry itself.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:501

          keyStore.deleteEntry(name);
        }
      } catch (KeyStoreException e) {
        throw new IOException("Problem removing " + name + " from " + this, e);
      }
      cache.remove(name);
      changed = true;
    } finally {
      writeLock.unlock();
    }
  }

  KeyVersion innerSetKeyVersion(String name, String versionName, byte[] material,
                                String cipher) throws IOException {
    try {
      keyStore.setKeyEntry(versionName, new SecretKeySpec(material, cipher),
          password, null);
    } catch (KeyStoreException e) {
      throw new IOException("Can't store key " + versionName + " in " + this,
          e);
    }
    changed = true;
    return new KeyVersion(name, versionName, material);
  }

  @Override
  public KeyVersion rollNewVersion(String name,
                                    byte[] material) throws IOException {
    writeLock.lock();
    try {
      Metadata meta = getMetadata(name);
      if (meta == null) {
        throw new IOException("Key " + name + " not found");
      }
      if (meta.getBitLength() != 8 * material.length) {
        throw new IOException("Wrong key length. Required " +
            meta.getBitLength() + ", but got " + (8 * material.length));

View on GitHub (pinned to 2add963021)

Solutions

1. Verify the keystore password is available (HADOOP_CREDSTORE_PASSWORD env or configured password file) and the store loads
2. Use a bare algorithm name for the cipher ('AES'), not a transformation ('AES/CBC/PKCS5Padding')
3. Check the key name/alias for characters the keystore rejects; stick to alphanumeric, '-' and '_'
4. If the store is corrupt, recreate it and re-add the keys

Example fix

// before
Options opts = new Options(conf).setCipher("AES/CBC/PKCS5Padding").setBitLength(128);

// after
Options opts = new Options(conf).setCipher("AES").setBitLength(128);

if (options.getCipher() != null && options.getCipher().contains("/")) {
  throw new IllegalArgumentException("cipher must be a bare algorithm, e.g. AES");
}

try { provider.createKey(name, material, options); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith("Can't store key")) { // check keystore password availability and cipher name, fix, then retry } else { throw e; } }

When it happens

Trigger: Keystore never properly initialized/loaded (constructed against an unreadable or malformed file); a cipher value in Options that the keystore provider cannot map to a secret-key algorithm (e.g. a transformation string 'AES/CBC/PKCS5Padding' instead of bare 'AES'); a null password where the store requires one; an alias with characters the store rejects.

Common situations: Missing keystore password (HADOOP_CREDSTORE_PASSWORD or password file not set); passing a cipher transformation instead of an algorithm name; keystores produced by a different provider version.

Related errors

• Problem removing ${versionName} from ${this}
• Problem removing ${name} from ${this}
• Can't store keystore ${this}
• Can't set metadata key ${entry.getKey()}
• Wrong key length. Required ${options.getBitLength()}, but go

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/61a59712581bee87. Report an issue: GitHub.