{"record":{"id":"1063aec2b312a2be","repo":"apache/iceberg","slug":"cannot-initialize-tlsconfigurer-implementation-s","errorCode":null,"errorMessage":"Cannot initialize TLSConfigurer implementation %s: %s","messagePattern":"Cannot initialize TLSConfigurer implementation (.+?): (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/apache/iceberg/rest/HTTPClient.java","lineNumber":452,"sourceCode":"\n    return connectionManagerBuilder.build();\n  }\n\n  private static TLSConfigurer loadTlsConfigurer(Map<String, String> properties) {\n    String impl = properties.get(REST_TLS_CONFIGURER);\n    if (impl == null) {\n      return null;\n    }\n\n    DynConstructors.Ctor<TLSConfigurer> ctor;\n    try {\n      ctor =\n          DynConstructors.builder(TLSConfigurer.class)\n              .loader(HTTPClient.class.getClassLoader())\n              .impl(impl)\n              .buildChecked();\n    } catch (NoSuchMethodException e) {\n      throw new IllegalArgumentException(\n          String.format(\n              \"Cannot initialize TLSConfigurer implementation %s: %s\", impl, e.getMessage()),\n          e);\n    }\n\n    TLSConfigurer configurer;\n    try {\n      configurer = ctor.newInstance();\n    } catch (ClassCastException e) {\n      throw new IllegalArgumentException(\n          String.format(\n              \"Cannot initialize TLSConfigurer, %s does not implement TLSConfigurer.\", impl),\n          e);\n    }\n\n    configurer.initialize(properties);\n\n    return configurer;","sourceCodeStart":434,"sourceCodeEnd":470,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/core/src/main/java/org/apache/iceberg/rest/HTTPClient.java#L434-L470","documentation":"When configuring custom TLS via the REST client's tls-implementation property, HTTPClient loads the implementation class reflectively with DynConstructors. If the class cannot be found or has no usable no-arg constructor (NoSuchMethodException), it throws IllegalArgumentException with this message. This is a configuration/classpath problem, not a TLS handshake failure.","triggerScenarios":"Setting rest.client.tls-implementation (or the equivalent TLS config) to a class name that is misspelled, absent from the classpath, or lacking a public no-argument constructor.","commonSituations":"Typo in the fully-qualified class name; the JAR containing the TLSConfigurer implementation is not on the Spark/Flink/worker classpath; the class requires constructor arguments; shaded/relocated class name used.","solutions":["Correct the fully-qualified class name in the configuration.","Ensure the JAR containing the class is on the runtime classpath of the client process (driver and executors).","Give the implementation a public no-argument constructor (it must implement TLSConfigurer).","Run with the default TLSConfigurer by removing the property to isolate whether the class loading is the problem."],"exampleFix":"// before: class missing or needs args\nclass MyTls implements TLSConfigurer {\n  MyTls(String path) { ... }\n}\n// after: public no-arg constructor, correct FQCN in config\npublic class MyTls implements TLSConfigurer {\n  public MyTls() {}\n  public void initialize(Map<String, String> properties) { ... }\n}","handlingStrategy":"validation","validationCode":"// pre-flight check before configuring\nClass<?> c = Class.forName(implClassName);\nif (!TLSConfigurer.class.isAssignableFrom(c)) throw new IllegalArgumentException(implClassName);\nif (c.getConstructor() == null) throw new IllegalArgumentException(\"no no-arg ctor: \" + implClassName);","typeGuard":null,"tryCatchPattern":"try {\n  client = HTTPClient.builder(map).uri(baseUri).build();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"Cannot initialize TLSConfigurer implementation\")) {\n    // fall back to default TLS config and log the bad class name\n  }\n  throw e;\n}","preventionTips":["Keep implementation JARs on the full runtime classpath (driver and executors).","Use a public no-arg constructor in custom TLSConfigurer implementations.","Double-check fully-qualified class names in configuration values."],"tags":["configuration","reflection","tls","classpath"],"backgroundTag":"invalid-config-value","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}