{"record":{"id":"0cad47932dc39f9b","repo":"apache/hadoop","slug":"the-truststore-location-parameter-is-empty-for-the","errorCode":null,"errorMessage":"The truststore location parameter is empty for the ZooKeeper client connection.","messagePattern":"The truststore location parameter is empty for the ZooKeeper client connection\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":864,"sourceCode":"      }\n    } catch (IOException | ZKUtil.BadAuthFormatException e) {\n      LOG.error(\"Couldn't read Auth based on {}\", configKey);\n      throw e;\n    }\n  }\n\n  public static void validateSslConfiguration(TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystoreLocation)) {\n      throw new ConfigurationException(\n          \"The keystore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystorePassword)) {\n      throw new ConfigurationException(\n          \"The keystore password parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststoreLocation)) {\n      throw new ConfigurationException(\n          \"The truststore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststorePassword)) {\n      throw new ConfigurationException(\n          \"The truststore password parameter is empty for the ZooKeeper client connection.\");\n    }\n  }\n\n  /**\n   * Configure ZooKeeper Client with SSL/TLS connection.\n   * @param zkClientConfig ZooKeeper Client configuration\n   * @param truststoreKeystore truststore keystore, that we use to set the SSL configurations\n   * @throws ConfigurationException if the SSL configs are empty\n   */\n  public static void setSslConfiguration(ZKClientConfig zkClientConfig,\n                                         TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    setSslConfiguration(zkClientConfig, truststoreKeystore, new ClientX509Util());","sourceCodeStart":846,"sourceCodeEnd":882,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L846-L882","documentation":"The third check in SecurityUtil.validateSslConfiguration: the truststore location must be non-empty once the keystore settings passed. Without a truststore the ZK client cannot verify the server certificate, so TLS setup aborts with ConfigurationException.","triggerScenarios":"ZK SSL configured with keystore location and password but the truststore location property is missing, e.g. an operator assumed the JVM default truststore would be used (this code path requires an explicit one).","commonSituations":"Config templates that only cover client-certificate material; environments migrating from JVM-wide javax.net.ssl.trustStore settings to explicit ZooKeeper properties.","solutions":["Set the zookeeper SSL truststore location property (zookeeper.ssl.truststore.location) to the truststore file path","Ensure the truststore contains the CA that signed the ZooKeeper server certificate","Verify the path is readable by the daemon user","Complete the set with the truststore password as well, or validation will fail on the next check"],"exampleFix":"<!-- before -->\n<property><name>zookeeper.ssl.keystore.location</name><value>/etc/zk/ssl/keystore.jks</value></property>\n\n<!-- after -->\n<property><name>zookeeper.ssl.keystore.location</name><value>/etc/zk/ssl/keystore.jks</value></property>\n<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>","handlingStrategy":"validation","validationCode":"String tsLoc = conf.get(\"zookeeper.ssl.truststore.location\");\nif (org.apache.commons.lang3.StringUtils.isEmpty(tsLoc)) {\n  throw new ConfigurationException(\n      \"zookeeper.ssl.truststore.location is required for secure ZK connections\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not rely on the JVM default truststore for ZooKeeper TLS; set the property explicitly","Verify the truststore contains the ZK server CA before deploy","Cover the full four-property set in config templates"],"tags":["ssl","tls","zookeeper","configuration","truststore"],"backgroundTag":"incomplete-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}