apache/hadoop · error · IllegalArgumentException

mode cannot be NULL

Error message

mode cannot be NULL

What it means

The SSLFactory constructor requires an explicit Mode (CLIENT or SERVER); passing null throws IllegalArgumentException immediately. The mode decides which SSL configuration file (client vs server) and which keystore properties are resolved, so a null mode is a programming error.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java:143

  private SSLSocketFactory socketFactory;
  private HostnameVerifier hostnameVerifier;
  private KeyStoresFactory keystoresFactory;

  private String[] enabledProtocols = null;
  private List<String> excludeCiphers;
  private List<String> includeCiphers;

  /**
   * Creates an SSLFactory.
   *
   * @param mode SSLFactory mode, client or server.
   * @param conf Hadoop configuration from where the SSLFactory configuration
   * will be read.
   */
  public SSLFactory(Mode mode, Configuration conf) {
    this.conf = conf;
    if (mode == null) {
      throw new IllegalArgumentException("mode cannot be NULL");
    }
    this.mode = mode;
    Configuration sslConf = readSSLConfiguration(conf, mode);

    requireClientCert = sslConf.getBoolean(SSL_REQUIRE_CLIENT_CERT_KEY,
        SSL_REQUIRE_CLIENT_CERT_DEFAULT);

    Class<? extends KeyStoresFactory> klass
      = conf.getClass(KEYSTORES_FACTORY_CLASS_KEY,
                      FileBasedKeyStoresFactory.class, KeyStoresFactory.class);
    keystoresFactory = ReflectionUtils.newInstance(klass, sslConf);

    enabledProtocols = conf.getStrings(SSL_ENABLED_PROTOCOLS_KEY,
        SSL_ENABLED_PROTOCOLS_DEFAULT);
    excludeCiphers = Arrays.asList(
        sslConf.getTrimmedStrings(SSL_SERVER_EXCLUDE_CIPHER_LIST));
    includeCiphers = Arrays.asList(
      sslConf.getTrimmedStrings(SSL_SERVER_INCLUDE_CIPHER_LIST));

View on GitHub (pinned to 2add963021)

Solutions

1. Pass Mode.SERVER for server-side sockets and Mode.CLIENT for client-side connections
2. Default or validate the mode before construction when it comes from configuration
3. Make the mode a required constructor parameter of your own wrapper so it cannot be omitted

Example fix

// before
SSLFactory factory = new SSLFactory(modeFromConfig, conf); // may be null

// after
SSLFactory.Mode mode = SSLFactory.Mode.valueOf(
    conf.get("my.tls.role", "CLIENT").toUpperCase(Locale.ROOT));
SSLFactory factory = new SSLFactory(mode, conf);

Objects.requireNonNull(mode, "SSLFactory mode must be CLIENT or SERVER");
SSLFactory factory = new SSLFactory(mode, conf);

private static SSLFactory.Mode resolveMode(String role) {
  return "server".equalsIgnoreCase(role) ? SSLFactory.Mode.SERVER : SSLFactory.Mode.CLIENT;
}

When it happens

Trigger: new SSLFactory(null, conf); a mode variable derived from config or a method parameter that was never initialized; conditional code that assigns mode only in some branches.

Common situations: Shared SSL helper classes where one caller forgot to pass the mode; refactors replacing an enum literal with a config-driven value that can be absent; unit tests constructing SSLFactory casually.

Related errors

• Property %s not specified
• Unknown channel mode: {}
• The property '{}' has not been set in the ssl configuration
• Unknown client chain certificate: {}
• Unknown server chain certificate: {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e60ecab936517fa7. Report an issue: GitHub.