apache/hadoop · error · ConfigurationException

The truststore location parameter is empty for the ZooKeeper

Error message

The truststore location parameter is empty for the ZooKeeper client connection.

What it means

The third check in SecurityUtil.validateSslConfiguration: the truststore location must be non-empty once the keystore settings passed. Without a truststore the ZK client cannot verify the server certificate, so TLS setup aborts with ConfigurationException.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java:864

      }
    } catch (IOException | ZKUtil.BadAuthFormatException e) {
      LOG.error("Couldn't read Auth based on {}", configKey);
      throw e;
    }
  }

  public static void validateSslConfiguration(TruststoreKeystore truststoreKeystore)
          throws ConfigurationException {
    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystoreLocation)) {
      throw new ConfigurationException(
          "The keystore location parameter is empty for the ZooKeeper client connection.");
    }
    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystorePassword)) {
      throw new ConfigurationException(
          "The keystore password parameter is empty for the ZooKeeper client connection.");
    }
    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststoreLocation)) {
      throw new ConfigurationException(
          "The truststore location parameter is empty for the ZooKeeper client connection.");
    }
    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststorePassword)) {
      throw new ConfigurationException(
          "The truststore password parameter is empty for the ZooKeeper client connection.");
    }
  }

  /**
   * Configure ZooKeeper Client with SSL/TLS connection.
   * @param zkClientConfig ZooKeeper Client configuration
   * @param truststoreKeystore truststore keystore, that we use to set the SSL configurations
   * @throws ConfigurationException if the SSL configs are empty
   */
  public static void setSslConfiguration(ZKClientConfig zkClientConfig,
                                         TruststoreKeystore truststoreKeystore)
          throws ConfigurationException {
    setSslConfiguration(zkClientConfig, truststoreKeystore, new ClientX509Util());

View on GitHub (pinned to 2add963021)

Solutions

1. Set the zookeeper SSL truststore location property (zookeeper.ssl.truststore.location) to the truststore file path
2. Ensure the truststore contains the CA that signed the ZooKeeper server certificate
3. Verify the path is readable by the daemon user
4. Complete the set with the truststore password as well, or validation will fail on the next check

Example fix

<!-- before -->
<property><name>zookeeper.ssl.keystore.location</name><value>/etc/zk/ssl/keystore.jks</value></property>

<!-- after -->
<property><name>zookeeper.ssl.keystore.location</name><value>/etc/zk/ssl/keystore.jks</value></property>
<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>

String tsLoc = conf.get("zookeeper.ssl.truststore.location");
if (org.apache.commons.lang3.StringUtils.isEmpty(tsLoc)) {
  throw new ConfigurationException(
      "zookeeper.ssl.truststore.location is required for secure ZK connections");
}

When it happens

Trigger: ZK SSL configured with keystore location and password but the truststore location property is missing, e.g. an operator assumed the JVM default truststore would be used (this code path requires an explicit one).

Common situations: Config templates that only cover client-certificate material; environments migrating from JVM-wide javax.net.ssl.trustStore settings to explicit ZooKeeper properties.

Related errors

• The SSL encryption is enabled for the component's ZooKeeper
• The SSL encryption is enabled for the component's ZooKeeper
• The keystore location parameter is empty for the ZooKeeper c
• The keystore password parameter is empty for the ZooKeeper c
• The truststore password parameter is empty for the ZooKeeper

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/0cad47932dc39f9b. Report an issue: GitHub.