{"record":{"id":"32046090ac81b5e9","repo":"apache/hadoop","slug":"certificate-exception-storing-keystore-this","errorCode":null,"errorMessage":"Certificate exception storing keystore ${this}","messagePattern":"Certificate exception storing keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":617,"sourceCode":"\n  private void cleanupNewAndOld(Path newPath, Path oldPath) throws IOException {\n    // Rename _NEW to CURRENT\n    renameOrFail(newPath, path);\n    // Delete _OLD\n    fs.delete(oldPath, true);\n  }\n\n  protected void writeToNew(Path newPath) throws IOException {\n    try (FSDataOutputStream out =\n        FileSystem.create(fs, newPath, permissions);) {\n      keyStore.store(out, password);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store keystore \" + this, e);\n    } catch (NoSuchAlgorithmException e) {\n      throw new IOException(\n          \"No such algorithm storing keystore \" + this, e);\n    } catch (CertificateException e) {\n      throw new IOException(\n          \"Certificate exception storing keystore \" + this, e);\n    }\n  }\n\n  protected boolean backupToOld(Path oldPath)\n      throws IOException {\n    try {\n      renameOrFail(path, oldPath);\n      return true;\n    } catch (FileNotFoundException e) {\n      return false;\n    }\n  }\n\n  private void revertFromOld(Path oldPath, boolean fileExisted)\n      throws IOException {\n    if (fileExisted) {\n      renameOrFail(oldPath, path);","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L599-L635","documentation":"CertificateException from KeyStore.store() while writing the JCEKS store: the provider hit certificate-related data it could not encode. Rare for pure secret-key stores; it points to corrupted certificate-bearing entries previously imported into the store, or a misbehaving security provider.","triggerScenarios":"A keystore containing a damaged certificate entry; mixed-use keystores (keys + certs) with an entry written by an incompatible tool; provider implementation faults during encoding.","commonSituations":"Keystore files managed by both keytool and Hadoop; stores migrated across Java versions; third-party PKI tooling leaving non-standard entries.","solutions":["List the store with keytool -list and identify/remove the offending certificate entry","Rebuild the keystore containing only Hadoop-managed key entries","Check the security provider implementation if the store is clean but the error persists"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { provider.flush(); } catch (IOException e) { if (e.getCause() instanceof java.security.cert.CertificateException) { // inspect store with keytool -list, remove the bad certificate entry, retry } else { throw e; } }","preventionTips":["Do not manage the same keystore file with keytool and Hadoop","Keep Hadoop keystores dedicated to key material","Validate imported stores with keytool -list before pointing Hadoop at them"],"tags":["java","hadoop","keystore","certificate","flush"],"backgroundTag":"keystore-persistence-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}