apache/hadoop · error · UnknownCryptoProtocolVersionException

No crypto protocol versions provided by the client are suppo

Error message

No crypto protocol versions provided by the client are supported. Client provided: {} NameNode supports: {}

What it means

For a create() inside an encryption zone the NameNode must agree with the client on a CryptoProtocolVersion, and it must equal the zone's recorded version. chooseProtocolVersion iterates the client-supplied supportedVersions (skipping UNKNOWN); if none equals the zone's required version it throws UnknownCryptoProtocolVersionException listing both the client's set and the server's supported values.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java:2746

      throws UnknownCryptoProtocolVersionException, UnresolvedLinkException,
        SnapshotAccessControlException {
    Preconditions.checkNotNull(zone);
    Preconditions.checkNotNull(supportedVersions);
    // Right now, we only support a single protocol version,
    // so simply look for it in the list of provided options
    final CryptoProtocolVersion required = zone.getVersion();

    for (CryptoProtocolVersion c : supportedVersions) {
      if (c.equals(CryptoProtocolVersion.UNKNOWN)) {
        LOG.debug("Ignoring unknown CryptoProtocolVersion provided by client: {}",
            c.getUnknownValue());
        continue;
      }
      if (c.equals(required)) {
        return c;
      }
    }
    throw new UnknownCryptoProtocolVersionException(
        "No crypto protocol versions provided by the client are supported."
            + " Client provided: " + Arrays.toString(supportedVersions)
            + " NameNode supports: " + Arrays.toString(CryptoProtocolVersion
            .values()));
  }

  /**
   * Create a new file entry in the namespace.
   * 
   * For description of parameters and exceptions thrown see
   * {@link ClientProtocol#create}, except it returns valid file status upon
   * success
   */
  HdfsFileStatus startFile(String src, PermissionStatus permissions,
      String holder, String clientMachine, EnumSet<CreateFlag> flag,
      boolean createParent, short replication, long blockSize,
      CryptoProtocolVersion[] supportedVersions, String ecPolicyName,
      String storagePolicy, boolean logRetryCache) throws IOException {

View on GitHub (pinned to 2add963021)

Solutions

Run the client with the same or newer Hadoop version as the NameNode so its supported version list includes the zone's version
Inspect the zone (hdfs crypto -listZones / zone metadata) and, if legacy clients must keep writing, recreate the zone with a protocol version those clients support
Workaround: write outside the zone, then move data in with a version-matched client (distcp)

Example fix

# before: old client jar writing into a zone created by a newer NameNode
hadoop jar app-old-deps.jar Writer /secure/data/file   # UnknownCryptoProtocolVersionException
# after: run the same job with the cluster's Hadoop version on the classpath
hadoop --config /etc/hadoop jar app.jar Writer /secure/data/file

Defensive patterns

Strategy: try-catch

Validate before calling

EncryptionZone ez = ((DistributedFileSystem) fs).getEncryptionZoneForPath(path);
if (ez != null) LOG.info("path is in EZ; zone crypto protocol version = {} — client must support it", ez.getVersion());

Try / catch

catch (UnknownCryptoProtocolVersionException e) { // client/server crypto-protocol skew: upgrade the client to the cluster version, or route the write through a version-matched client (distcp) }

Prevention

Pin client Hadoop versions to the cluster version on TDE deployments
During long rolling upgrades, keep zones on the lowest protocol version still needed

When it happens

Trigger: A client whose DFSClient advertises crypto protocol versions that exclude the zone's version calls create/append on a path inside that encryption zone — e.g., an older client jar writing into a zone created by a newer Hadoop release with a higher protocol version.

Common situations: Mixed-version clusters during or after rolling upgrades; third-party apps pinned to an old hadoop-client writing into TDE zones; vendor-vs-Apache distro differences in CryptoProtocolVersion support.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/e2435e22056ea744. Report an issue: GitHub.