{"record":{"id":"1368ab1478612767","repo":"apache/hadoop","slug":"the-ssl-encryption-is-enabled-for-the-component-s","errorCode":null,"errorMessage":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop.zk.ssl.keystore.location parameter is empty.","messagePattern":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop\\.zk\\.ssl\\.keystore\\.location parameter is empty\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java","lineNumber":220,"sourceCode":"      validateSslConfiguration(conf);\n    }\n    CuratorFramework client = CuratorFrameworkFactory.builder().connectString(zkHostPort)\n        .zookeeperFactory(\n            new HadoopZookeeperFactory(conf.get(CommonConfigurationKeys.ZK_SERVER_PRINCIPAL),\n                conf.get(CommonConfigurationKeys.ZK_KERBEROS_PRINCIPAL),\n                conf.get(CommonConfigurationKeys.ZK_KERBEROS_KEYTAB), sslEnabled,\n                new TruststoreKeystore(conf))).zkClientConfig(zkClientConfig)\n        .sessionTimeoutMs(zkSessionTimeout).retryPolicy(retryPolicy)\n        .authorization(authInfos).build();\n    client.start();\n\n    this.curator = client;\n  }\n  /* Check on SSL/TLS client connection requirements to emit the name of the\n   configuration missing. It improves supportability. */\n  private void validateSslConfiguration(Configuration config) throws IOException {\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's \" + \"ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD))) {\n      throw new IOException(","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java#L202-L238","documentation":"When start() runs with sslEnabled=true it calls validateSslConfiguration before building the Curator client. A ZooKeeper TLS client needs a local keystore, so hadoop.zk.ssl.keystore.location must be present and non-empty; a missing, blank, or whitespace-only value fails the StringUtils.isEmpty check and throws IOException.","triggerScenarios":"start(authInfos, true, ...) with hadoop.zk.ssl.keystore.location missing, declared as <value></value>, or whitespace-only; the key misspelled (e.g. hadoop.zk.ssl.keyStore.location); the config file defining it not loaded into the failing Configuration.","commonSituations":"Enabling ZooKeeper TLS when only server-side SSL was configured; templates declaring the property with an empty placeholder; environment-specific core-site.xml not shipped to the nodes.","solutions":["Set hadoop.zk.ssl.keystore.location to the absolute path of the client keystore (JKS/PKCS12) in core-site.xml","Verify exact key spelling and that the file exists and is readable by the service user","Confirm the key is visible in the failing process (log conf.get(\"hadoop.zk.ssl.keystore.location\") or dump the Configuration)"],"exampleFix":"<!-- before -->\n<property><name>hadoop.zk.ssl.enabled</name><value>true</value></property>\n<!-- keystore.location missing -> IOException at start() -->\n\n<!-- after -->\n<property><name>hadoop.zk.ssl.enabled</name><value>true</value></property>\n<property>\n  <name>hadoop.zk.ssl.keystore.location</name>\n  <value>/etc/security/zk/client.keystore.p12</value>\n</property>","handlingStrategy":"validation","validationCode":"String loc = conf.get(\"hadoop.zk.ssl.keystore.location\");\nif (loc == null || loc.trim().isEmpty()) {\n  throw new IllegalStateException(\"hadoop.zk.ssl.keystore.location is required when SSL is enabled\");\n}\nzkManager.start(authInfos, true, null);","typeGuard":null,"tryCatchPattern":"try {\n  zkManager.start(authInfos, true, null);\n} catch (IOException e) {\n  LOG.error(\"ZK SSL bootstrap failed ({}); verify the hadoop.zk.ssl.* properties\", e.getMessage());\n  throw e;\n}","preventionTips":["Deploy the full hadoop.zk.ssl.* property set as one unit - enabling TLS half-configured always fails here","Smoke-test config completeness at service start with a pre-flight check of all four keys","Keep keystore files deployed alongside the configs that reference them"],"tags":["hadoop","zookeeper","ssl","tls","keystore","configuration","java"],"backgroundTag":"missing-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}