{"record":{"id":"008ebfeab7d2a293","repo":"apache/hadoop","slug":"can-t-store-keystore-this","errorCode":null,"errorMessage":"Can't store keystore ${this}","messagePattern":"Can't store keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":612,"sourceCode":"      LOG.debug(\"KeyStore resetting to previously flushed state !!\");\n    } catch (Exception e) {\n      LOG.debug(\"Could not reset Keystore to previous state\", e);\n    }\n  }\n\n  private void cleanupNewAndOld(Path newPath, Path oldPath) throws IOException {\n    // Rename _NEW to CURRENT\n    renameOrFail(newPath, path);\n    // Delete _OLD\n    fs.delete(oldPath, true);\n  }\n\n  protected void writeToNew(Path newPath) throws IOException {\n    try (FSDataOutputStream out =\n        FileSystem.create(fs, newPath, permissions);) {\n      keyStore.store(out, password);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store keystore \" + this, e);\n    } catch (NoSuchAlgorithmException e) {\n      throw new IOException(\n          \"No such algorithm storing keystore \" + this, e);\n    } catch (CertificateException e) {\n      throw new IOException(\n          \"Certificate exception storing keystore \" + this, e);\n    }\n  }\n\n  protected boolean backupToOld(Path oldPath)\n      throws IOException {\n    try {\n      renameOrFail(path, oldPath);\n      return true;\n    } catch (FileNotFoundException e) {\n      return false;\n    }\n  }","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L594-L630","documentation":"writeToNew serializes the whole keystore to the *_NEW file during flush; KeyStore.store() threw KeyStoreException, meaning the in-memory KeyStore could not be encoded at all (an uninitialized or internally inconsistent store instance, rather than a filesystem problem - FS errors surface as plain IOExceptions from the stream). The flush aborts before the old file is backed up, so the previous on-disk keystore is untouched but all pending updates are lost.","triggerScenarios":"A KeyStore instance that was never load()ed successfully; entries in an encoding-incompatible state after corruption; provider-level failure during serialization.","commonSituations":"Keystore file unreadable at provider construction so the store is empty/uninitialized; corrupt store loaded partially; JVM provider bugs.","solutions":["Check that the current keystore file is loadable and not corrupt (`hadoop key list -provider <uri>`)","Remove leftover *_NEW/_OLD files and retry the flush","If the store is unrecoverable, recreate the keystore and re-add keys from secure backups","Confirm a stable, standard JCE configuration in the JVM"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: prove the store serializes before relying on flush\ntry { provider.getKeys(); } catch (IOException e) { throw new IllegalStateException(\"keystore unhealthy: \" + e.getMessage(), e); }","typeGuard":null,"tryCatchPattern":"try { provider.flush(); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith(\"Can't store keystore\")) { // CRITICAL: pending keys NOT persisted; keep process alive if keys remain in cache, alert ops, repair store and re-flush } throw e; }","preventionTips":["Never assume a createKey/rollNewVersion succeeded durably until flush returns","Canary-test keystore write+flush at service startup","Back up keystore files and verify restore path","Monitor for *_NEW/_OLD residue as crash evidence"],"tags":["java","hadoop","keystore","key-provider","flush","jceks"],"backgroundTag":"keystore-persistence-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}