{"record":{"id":"321bea36a8743990","repo":"apache/hadoop","slug":"factory-is-not-in-server-mode-actual-mode-is","errorCode":null,"errorMessage":"Factory is not in SERVER mode. Actual mode is {}","messagePattern":"Factory is not in SERVER mode\\. Actual mode is (.+?)","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java","lineNumber":303,"sourceCode":"    }\n    String[] enabledCipherSuites = cipherSuites.toArray(String[]::new);\n    LOG.debug(\"Enabled cipher suites: {}\", StringUtils.join(\",\", enabledCipherSuites));\n    sslEngine.setEnabledCipherSuites(enabledCipherSuites);\n  }\n\n  /**\n   * Returns a configured SSLServerSocketFactory.\n   *\n   * @return the configured SSLSocketFactory.\n   * @throws GeneralSecurityException thrown if the SSLSocketFactory could not\n   * be initialized.\n   * @throws IOException thrown if and IO error occurred while loading\n   * the server keystore.\n   */\n  public SSLServerSocketFactory createSSLServerSocketFactory()\n    throws GeneralSecurityException, IOException {\n    if (mode != Mode.SERVER) {\n      throw new IllegalStateException(\n          \"Factory is not in SERVER mode. Actual mode is \" + mode.toString());\n    }\n    return context.getServerSocketFactory();\n  }\n\n  /**\n   * Returns a configured SSLSocketFactory.\n   *\n   * @return the configured SSLSocketFactory.\n   * @throws GeneralSecurityException thrown if the SSLSocketFactory could not\n   * be initialized.\n   * @throws IOException thrown if and IO error occurred while loading\n   * the server keystore.\n   */\n  public SSLSocketFactory createSSLSocketFactory()\n    throws GeneralSecurityException, IOException {\n    if (mode != Mode.CLIENT) {\n      throw new IllegalStateException(","sourceCodeStart":285,"sourceCodeEnd":321,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java#L285-L321","documentation":"SSLFactory.createSSLServerSocketFactory requires the factory to have been constructed with Mode.SERVER; calling it on a client-mode instance throws IllegalStateException naming the actual mode. SSLFactory binds its keystore/truststore resolution to the mode at construction time, so a client factory cannot produce server sockets.","triggerScenarios":"new SSLFactory(Mode.CLIENT, conf).createSSLServerSocketFactory(); a shared/cached SSLFactory intended for outbound connections reused to accept inbound TLS; a flag that picks the mode inverted at one call site.","commonSituations":"Utility code that caches one SSLFactory per configuration and serves both directions; refactors of HTTP servers where the client factory remained in place; tests parameterized over the wrong mode.","solutions":["Construct a separate SSLFactory with Mode.SERVER for server-side acceptors and keep the client factory for outbound connections","Track the Mode you constructed with and assert it before calling createSSLServerSocketFactory()","Destroy and rebuild the factory when the required role changes instead of reusing across modes"],"exampleFix":"// before: one shared client factory\nSSLFactory shared = new SSLFactory(SSLFactory.Mode.CLIENT, conf);\nSSLServerSocketFactory ssf = shared.createSSLServerSocketFactory(); // IllegalStateException\n\n// after: one factory per role\nSSLFactory clientFactory = new SSLFactory(SSLFactory.Mode.CLIENT, conf);\nSSLFactory serverFactory = new SSLFactory(SSLFactory.Mode.SERVER, conf);\nSSLServerSocketFactory ssf = serverFactory.createSSLServerSocketFactory();","handlingStrategy":"validation","validationCode":"SSLFactory.Mode required = SSLFactory.Mode.SERVER;\nif (constructedMode != required) {\n  throw new IllegalStateException(\n      \"Need an SSLFactory built with \" + required + \" to create server sockets; got \" + constructedMode);\n}\nSSLServerSocketFactory ssf = factory.createSSLServerSocketFactory();","typeGuard":"private static boolean canCreateServerSockets(SSLFactory factory, SSLFactory.Mode builtWith) {\n  return builtWith == SSLFactory.Mode.SERVER;\n}","tryCatchPattern":"try {\n  return factory.createSSLServerSocketFactory();\n} catch (IllegalStateException e) {\n  if (e.getMessage().contains(\"not in SERVER mode\")) {\n    // rebuild the factory with Mode.SERVER rather than retrying\n    factory.destroy();\n    factory = new SSLFactory(SSLFactory.Mode.SERVER, conf);\n    return factory.createSSLServerSocketFactory();\n  }\n  throw e;\n}","preventionTips":["Create and cache one SSLFactory per role (client and server) instead of one shared instance","Store the Mode used at construction next to the factory reference","Call destroy() and rebuild when the role genuinely changes"],"tags":["ssl","tls","illegal-state","mode-mismatch","hadoop"],"backgroundTag":"wrong-mode-invocation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}