apache/hadoop · error · IOException

Property not specified

Error message

Property %s not specified

What it means

HttpServer2.Builder.loadSSLConfiguration() runs when the builder was given an SSL configuration (HTTPS enabled). It requires ssl.server.keystore.location to be present and non-blank (read with getTrimmed) and throws IOException naming the missing property. This is the first and most common check hit when enabling TLS on any Hadoop daemon's web UI.

Solutions

1. Add <property><name>ssl.server.keystore.location</name><value>/etc/security/keystores/server.jks</value></property> to ssl-server.xml on the node (and typically all nodes)
2. Confirm the ssl-server.xml is actually being loaded and the property name matches exactly (no trailing spaces)
3. Verify the keystore file exists and is readable by the daemon user at that path
4. If SSL was enabled unintentionally, fix the hadoop.ssl.enabled / service HTTP-vs-HTTPS setting instead

Example fix

<!-- ssl-server.xml before: missing keystore location -->
<configuration/>

<!-- after -->
<configuration>
  <property>
    <name>ssl.server.keystore.location</name>
    <value>/etc/security/keystores/server.jks</value>
  </property>
</configuration>

Configuration ssl = new Configuration(false);
ssl.addResource("ssl-server.xml");
String ks = ssl.getTrimmed("ssl.server.keystore.location");
if (ks == null || ks.isEmpty() || !new File(ks).canRead()) {
  throw new ConfigValidationException("ssl.server.keystore.location missing or unreadable: " + ks);
}
new HttpServer2.Builder()...build();

When it happens

Trigger: Starting NameNode/DataNode/JournalNode/JobHistory/KMS/HttpFS with HTTP-level SSL enabled (hadoop.ssl.enabled / service HTTPS settings that load ssl-server.xml) where ssl-server.xml lacks ssl.server.keystore.location or the property value is empty/whitespace.

Common situations: Enabling TLS but forgetting to deploy ssl-server.xml to that node; a typo'd property name; an empty <value/> tag; pointing at a keystore path that is set on one host but not others in the cluster.

Related errors

• The property ' ' has not been set in the ssl configuration…
• The SSL encryption is enabled for the component's ZooKeeper…
• The SSL encryption is enabled for the component's ZooKeeper…
• Invalid hostname verifier
• The keystore location parameter is empty for the ZooKeeper…

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/803651d6a7f92e13. Report an issue: GitHub.

Appendix: source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java:472

      if (passchars == null) {
        return null;
      }
      return new String(passchars);
    }

    /**
     * Load SSL properties from the SSL configuration.
     */
    private void loadSSLConfiguration() throws IOException {
      if (sslConf == null) {
        return;
      }
      needsClientAuth = sslConf.getBoolean(
          SSLFactory.SSL_SERVER_NEED_CLIENT_AUTH,
          SSLFactory.SSL_SERVER_NEED_CLIENT_AUTH_DEFAULT);
      keyStore = sslConf.getTrimmed(SSLFactory.SSL_SERVER_KEYSTORE_LOCATION);
      if (keyStore == null || keyStore.isEmpty()) {
        throw new IOException(String.format("Property %s not specified",
            SSLFactory.SSL_SERVER_KEYSTORE_LOCATION));
      }
      keyStorePassword = getPasswordString(sslConf,
          SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD);
      if (keyStorePassword == null) {
        throw new IOException(String.format("Property %s not specified",
            SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD));
      }
      keyStoreType = sslConf.get(SSLFactory.SSL_SERVER_KEYSTORE_TYPE,
          SSLFactory.SSL_SERVER_KEYSTORE_TYPE_DEFAULT);
      keyPassword = getPasswordString(sslConf,
          SSLFactory.SSL_SERVER_KEYSTORE_KEYPASSWORD);
      trustStore = sslConf.get(SSLFactory.SSL_SERVER_TRUSTSTORE_LOCATION);
      trustStorePassword = getPasswordString(sslConf,
          SSLFactory.SSL_SERVER_TRUSTSTORE_PASSWORD);
      trustStoreType = sslConf.get(SSLFactory.SSL_SERVER_TRUSTSTORE_TYPE,
          SSLFactory.SSL_SERVER_TRUSTSTORE_TYPE_DEFAULT);
      excludeCiphers = sslConf.get(SSLFactory.SSL_SERVER_EXCLUDE_CIPHER_LIST);

View on GitHub (pinned to 2add963021)