apache/hadoop · error · IllegalStateException

Factory is not in SERVER mode. Actual mode is {}

Error message

Factory is not in SERVER mode. Actual mode is {}

What it means

SSLFactory.createSSLServerSocketFactory requires the factory to have been constructed with Mode.SERVER; calling it on a client-mode instance throws IllegalStateException naming the actual mode. SSLFactory binds its keystore/truststore resolution to the mode at construction time, so a client factory cannot produce server sockets.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java:303

    }
    String[] enabledCipherSuites = cipherSuites.toArray(String[]::new);
    LOG.debug("Enabled cipher suites: {}", StringUtils.join(",", enabledCipherSuites));
    sslEngine.setEnabledCipherSuites(enabledCipherSuites);
  }

  /**
   * Returns a configured SSLServerSocketFactory.
   *
   * @return the configured SSLSocketFactory.
   * @throws GeneralSecurityException thrown if the SSLSocketFactory could not
   * be initialized.
   * @throws IOException thrown if and IO error occurred while loading
   * the server keystore.
   */
  public SSLServerSocketFactory createSSLServerSocketFactory()
    throws GeneralSecurityException, IOException {
    if (mode != Mode.SERVER) {
      throw new IllegalStateException(
          "Factory is not in SERVER mode. Actual mode is " + mode.toString());
    }
    return context.getServerSocketFactory();
  }

  /**
   * Returns a configured SSLSocketFactory.
   *
   * @return the configured SSLSocketFactory.
   * @throws GeneralSecurityException thrown if the SSLSocketFactory could not
   * be initialized.
   * @throws IOException thrown if and IO error occurred while loading
   * the server keystore.
   */
  public SSLSocketFactory createSSLSocketFactory()
    throws GeneralSecurityException, IOException {
    if (mode != Mode.CLIENT) {
      throw new IllegalStateException(

View on GitHub (pinned to 2add963021)

Solutions

1. Construct a separate SSLFactory with Mode.SERVER for server-side acceptors and keep the client factory for outbound connections
2. Track the Mode you constructed with and assert it before calling createSSLServerSocketFactory()
3. Destroy and rebuild the factory when the required role changes instead of reusing across modes

Example fix

// before: one shared client factory
SSLFactory shared = new SSLFactory(SSLFactory.Mode.CLIENT, conf);
SSLServerSocketFactory ssf = shared.createSSLServerSocketFactory(); // IllegalStateException

// after: one factory per role
SSLFactory clientFactory = new SSLFactory(SSLFactory.Mode.CLIENT, conf);
SSLFactory serverFactory = new SSLFactory(SSLFactory.Mode.SERVER, conf);
SSLServerSocketFactory ssf = serverFactory.createSSLServerSocketFactory();

SSLFactory.Mode required = SSLFactory.Mode.SERVER;
if (constructedMode != required) {
  throw new IllegalStateException(
      "Need an SSLFactory built with " + required + " to create server sockets; got " + constructedMode);
}
SSLServerSocketFactory ssf = factory.createSSLServerSocketFactory();

private static boolean canCreateServerSockets(SSLFactory factory, SSLFactory.Mode builtWith) {
  return builtWith == SSLFactory.Mode.SERVER;
}

try {
  return factory.createSSLServerSocketFactory();
} catch (IllegalStateException e) {
  if (e.getMessage().contains("not in SERVER mode")) {
    // rebuild the factory with Mode.SERVER rather than retrying
    factory.destroy();
    factory = new SSLFactory(SSLFactory.Mode.SERVER, conf);
    return factory.createSSLServerSocketFactory();
  }
  throw e;
}

When it happens

Trigger: new SSLFactory(Mode.CLIENT, conf).createSSLServerSocketFactory(); a shared/cached SSLFactory intended for outbound connections reused to accept inbound TLS; a flag that picks the mode inverted at one call site.

Common situations: Utility code that caches one SSLFactory per configuration and serves both directions; refactors of HTTP servers where the client factory remained in place; tests parameterized over the wrong mode.

Related errors

• Property %s not specified
• Unknown channel mode: {}
• The property '{}' has not been set in the ssl configuration
• Unknown client chain certificate: {}
• Unknown server chain certificate: {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/321bea36a8743990. Report an issue: GitHub.