What causes "Invalid hostname verifier: {}" in apache/hadoop?

Use one of the exact uppercase values: DEFAULT, DEFAULT_AND_LOCALHOST, STRICT, STRICT_IE6, ALLOW_ALL

apache/hadoop · error · GeneralSecurityException

Invalid hostname verifier: {}

Error message

Invalid hostname verifier: {}

What it means

SSLFactory reads hadoop.ssl.hostname.verifier from the SSL configuration and accepts exactly five values: DEFAULT, DEFAULT_AND_LOCALHOST, STRICT, STRICT_IE6, ALLOW_ALL. Any other string makes getHostnameVerifier throw GeneralSecurityException during SSLFactory initialization.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java:234

    return getHostnameVerifier(StringUtils.toUpperCase(
        conf.get(SSL_HOSTNAME_VERIFIER_KEY, "DEFAULT").trim()));
  }

  public static HostnameVerifier getHostnameVerifier(String verifier)
    throws GeneralSecurityException, IOException {
    HostnameVerifier hostnameVerifier;
    if (verifier.equals("DEFAULT")) {
      hostnameVerifier = SSLHostnameVerifier.DEFAULT;
    } else if (verifier.equals("DEFAULT_AND_LOCALHOST")) {
      hostnameVerifier = SSLHostnameVerifier.DEFAULT_AND_LOCALHOST;
    } else if (verifier.equals("STRICT")) {
      hostnameVerifier = SSLHostnameVerifier.STRICT;
    } else if (verifier.equals("STRICT_IE6")) {
      hostnameVerifier = SSLHostnameVerifier.STRICT_IE6;
    } else if (verifier.equals("ALLOW_ALL")) {
      hostnameVerifier = SSLHostnameVerifier.ALLOW_ALL;
    } else {
      throw new GeneralSecurityException("Invalid hostname verifier: " +
                                         verifier);
    }
    return hostnameVerifier;
  }

  /**
   * Releases any resources being used.
   */
  public void destroy() {
    keystoresFactory.destroy();
  }
  /**
   * Returns the SSLFactory KeyStoresFactory instance.
   *
   * @return the SSLFactory KeyStoresFactory instance.
   */
  public KeyStoresFactory getKeystoresFactory() {
    return keystoresFactory;

View on GitHub (pinned to 2add963021)

Solutions

Use one of the exact uppercase values: DEFAULT, DEFAULT_AND_LOCALHOST, STRICT, STRICT_IE6, ALLOW_ALL
Remove the property to fall back to the default verifier if you do not need a special mode
Keep STRICT (or DEFAULT) in production; use ALLOW_ALL only in test environments

Example fix

<!-- before -->
<property>
  <name>hadoop.ssl.hostname.verifier</name>
  <value>allow_all</value>
</property>

<!-- after -->
<property>
  <name>hadoop.ssl.hostname.verifier</name>
  <value>DEFAULT</value>
</property>

Defensive patterns

Strategy: validation

Validate before calling

private static final Set<String> VALID_VERIFIERS = new HashSet<>(Arrays.asList(
    "DEFAULT", "DEFAULT_AND_LOCALHOST", "STRICT", "STRICT_IE6", "ALLOW_ALL"));

String verifier = sslConf.get("hadoop.ssl.hostname.verifier", "DEFAULT").trim().toUpperCase(Locale.ROOT);
if (!VALID_VERIFIERS.contains(verifier)) {
  throw new IllegalStateException(
      "Invalid hadoop.ssl.hostname.verifier: " + verifier
      + "; allowed: " + VALID_VERIFIERS);
}

Try / catch

try {
  factory = new SSLFactory(mode, conf);
} catch (GeneralSecurityException e) {
  if (e.getMessage().startsWith("Invalid hostname verifier")) {
    throw new IllegalStateException("Fix hadoop.ssl.hostname.verifier in ssl config", e);
  }
  throw e;
}

Prevention

Copy verifier values from the current Hadoop SSL documentation, in exact uppercase
Validate SSL config files in CI against the allowed set
Avoid ALLOW_ALL outside test clusters — it disables hostname verification

When it happens

Trigger: Setting hadoop.ssl.hostname.verifier to an unsupported value in ssl-server.xml/ssl-client.xml — lowercase 'allow_all', 'strict-ietf', or a fully-qualified class name (this Hadoop version does not support class names here).

Common situations: Copy/paste from older docs or other projects; attempts to plug a custom HostnameVerifier; case-sensitive values entered lowercase.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/3d2cf75c66b4829d. Report an issue: GitHub.