apache/hadoop · error · IOException

Certificate exception storing keystore ${this}

Error message

Certificate exception storing keystore ${this}

What it means

CertificateException from KeyStore.store() while writing the JCEKS store: the provider hit certificate-related data it could not encode. Rare for pure secret-key stores; it points to corrupted certificate-bearing entries previously imported into the store, or a misbehaving security provider.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java:617

  private void cleanupNewAndOld(Path newPath, Path oldPath) throws IOException {
    // Rename _NEW to CURRENT
    renameOrFail(newPath, path);
    // Delete _OLD
    fs.delete(oldPath, true);
  }

  protected void writeToNew(Path newPath) throws IOException {
    try (FSDataOutputStream out =
        FileSystem.create(fs, newPath, permissions);) {
      keyStore.store(out, password);
    } catch (KeyStoreException e) {
      throw new IOException("Can't store keystore " + this, e);
    } catch (NoSuchAlgorithmException e) {
      throw new IOException(
          "No such algorithm storing keystore " + this, e);
    } catch (CertificateException e) {
      throw new IOException(
          "Certificate exception storing keystore " + this, e);
    }
  }

  protected boolean backupToOld(Path oldPath)
      throws IOException {
    try {
      renameOrFail(path, oldPath);
      return true;
    } catch (FileNotFoundException e) {
      return false;
    }
  }

  private void revertFromOld(Path oldPath, boolean fileExisted)
      throws IOException {
    if (fileExisted) {
      renameOrFail(oldPath, path);

View on GitHub (pinned to 2add963021)

Solutions

1. List the store with keytool -list and identify/remove the offending certificate entry
2. Rebuild the keystore containing only Hadoop-managed key entries
3. Check the security provider implementation if the store is clean but the error persists

try { provider.flush(); } catch (IOException e) { if (e.getCause() instanceof java.security.cert.CertificateException) { // inspect store with keytool -list, remove the bad certificate entry, retry } else { throw e; } }

When it happens

Trigger: A keystore containing a damaged certificate entry; mixed-use keystores (keys + certs) with an entry written by an incompatible tool; provider implementation faults during encoding.

Common situations: Keystore files managed by both keytool and Hadoop; stores migrated across Java versions; third-party PKI tooling leaving non-standard entries.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Can't set metadata key ${entry.getKey()}
• Can't store keystore ${this}
• Certificate exception storing keystore {}
• Problem removing ${versionName} from ${this}
• Problem removing ${name} from ${this}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/32046090ac81b5e9. Report an issue: GitHub.