{"record":{"id":"025f6c3632d76dc5","repo":"apache/hadoop","slug":"the-ssl-encryption-is-enabled-for-the-component-s-025f6c","errorCode":null,"errorMessage":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop.zk.ssl.truststore.location parameter is empty.","messagePattern":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop\\.zk\\.ssl\\.truststore\\.location parameter is empty\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java","lineNumber":232,"sourceCode":"    this.curator = client;\n  }\n  /* Check on SSL/TLS client connection requirements to emit the name of the\n   configuration missing. It improves supportability. */\n  private void validateSslConfiguration(Configuration config) throws IOException {\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's \" + \"ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD + \"  \" +\n              \"parameter is empty.\");\n    }\n  }\n\n  /**\n   * Get ACLs for a ZNode.\n   * @param path Path of the ZNode.\n   * @return The list of ACLs.\n   * @throws Exception If it cannot contact Zookeeper.\n   */","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java#L214-L250","documentation":"The third check in validateSslConfiguration requires hadoop.zk.ssl.truststore.location, the truststore holding the CA/server certificates the client uses to validate the ZooKeeper server. A missing or empty value throws IOException before the client starts, even if the keystore settings are complete.","triggerScenarios":"sslEnabled=true with hadoop.zk.ssl.truststore.location unset, empty, or misspelled; keystore configured but the cluster CA was only ever distributed to servers; truststore path pointing to a file not deployed on this node.","commonSituations":"Client-side TLS configured with a keystore but no truststore; teams assuming the JVM cacerts default applies - this API requires an explicit truststore; per-environment configs where only one env got the truststore path.","solutions":["Set hadoop.zk.ssl.truststore.location to the truststore path (commonly JKS containing the cluster CA) in core-site.xml","Deploy the truststore file to every node running the ZooKeeper client component and make it readable by the service user","Verify with conf.get(\"hadoop.zk.ssl.truststore.location\") that the key resolves in the failing process"],"exampleFix":"<!-- before -->\n<property><name>hadoop.zk.ssl.keystore.location</name><value>/etc/security/zk/client.p12</value></property>\n<!-- truststore.location missing -> IOException at start() -->\n\n<!-- after: add -->\n<property>\n  <name>hadoop.zk.ssl.truststore.location</name>\n  <value>/etc/security/zk/truststore.jks</value>\n</property>","handlingStrategy":"validation","validationCode":"String ts = conf.get(\"hadoop.zk.ssl.truststore.location\");\nif (ts == null || ts.trim().isEmpty()) {\n  throw new IllegalStateException(\"hadoop.zk.ssl.truststore.location is required when SSL is enabled\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  zkManager.start(authInfos, true, null);\n} catch (IOException e) {\n  LOG.error(\"ZK SSL config incomplete: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Distribute the cluster CA truststore to client nodes as part of TLS rollout","Do not assume JVM default cacerts - this API requires the explicit property","Pair every keystore deploy with its truststore in the same config change"],"tags":["hadoop","zookeeper","ssl","tls","truststore","configuration","java"],"backgroundTag":"missing-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}