{"record":{"id":"2d60ce0c4890329d","repo":"t8y2/dbx","slug":"hive-ca-certificate-contains-no-certificates-2d60ce","errorCode":null,"errorMessage":"Hive CA certificate contains no certificates","messagePattern":"Hive CA certificate contains no certificates","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1062,"sourceCode":"func buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {\n\tenabled := params.SSL || parameterBool(values, \"ssl\") || strings.EqualFold(parameter(values, \"ssl\"), \"true\")\n\tif !enabled {\n\t\treturn nil, nil\n\t}\n\tconfig := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}\n\tif parameterBool(values, \"sslinsecureskipverify\") || parameterBool(values, \"allowselfsigned\") {\n\t\tconfig.InsecureSkipVerify = true\n\t}\n\tvar customRoots *x509.CertPool\n\tcredentialProviderPath := parameter(values, \"storepasswordpath\")\n\tif path := strings.TrimSpace(params.CACertPath); path != \"\" {\n\t\tcontents, err := os.ReadFile(path)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Hive CA certificate: %w\", err)\n\t\t}\n\t\tcustomRoots = x509.NewCertPool()\n\t\tif !customRoots.AppendCertsFromPEM(contents) {\n\t\t\treturn nil, errors.New(\"Hive CA certificate contains no certificates\")\n\t\t}\n\t}\n\ttrustStoreLocation := parameter(values, \"ssltruststore\")\n\tif trustStoreLocation != \"\" {\n\t\tif parameter(values, \"truststorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}","sourceCodeStart":1044,"sourceCodeEnd":1080,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1044-L1080","documentation":"When sslCACertificate (a PEM file path) is configured, the driver reads the file and calls AppendCertsFromPEM to build the TLS root pool. If the PEM content yields no parseable certificates, it refuses to continue with an empty CA pool rather than silently enabling insecure TLS.","triggerScenarios":"Setting sslCACertificate to a file that is not a PEM certificate — an empty file, a DER-encoded cert, a PKCS#12 bundle, or a text/HTML page saved by mistake.","commonSituations":"Downloading a CA file that returns an HTML error page; exporting from Java keytool in DER/PKCS12 format; copying the wrong file (private key only); empty file mounted into a container.","solutions":["Replace the file with a PEM-encoded certificate (-----BEGIN CERTIFICATE----- blocks).","Convert DER/PKCS12 to PEM (e.g. openssl x509 -inform der -in cert.der -out cert.pem).","Verify with `openssl x509 -in ca.pem -noout -subject` that the file parses.","Re-download the CA bundle from the server/issuer and confirm it is non-empty."],"exampleFix":"// before\nparams.SSLCACertificate = \"/etc/certs/truststore.p12\"   // PKCS12, not PEM\n// after\nparams.SSLCACertificate = \"/etc/certs/ca-chain.pem\"     // PEM-encoded CA","handlingStrategy":"validation","validationCode":"contents, err := os.ReadFile(caPath)\nif err != nil { return err }\nif !x509.NewCertPool().AppendCertsFromPEM(contents) {\n\treturn fmt.Errorf(\"%s is not a PEM certificate file\", caPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure CA files are PEM (-----BEGIN CERTIFICATE-----) not DER/PKCS12","Validate CA files with `openssl x509 -in file -noout -subject` in CI","Check downloaded files are not HTML error pages before installing them as CAs"],"tags":["tls","certificates","pem","config"],"backgroundTag":"invalid-ca-certificate","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}