{"record":{"id":"3cdfaa0ea0540f9d","repo":"apache/hadoop","slug":"the-ssl-encryption-is-enabled-for-the-component-s-3cdfaa","errorCode":null,"errorMessage":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop.zk.ssl.truststore.password  parameter is empty.","messagePattern":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop\\.zk\\.ssl\\.truststore\\.password  parameter is empty\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java","lineNumber":238,"sourceCode":"      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's \" + \"ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD + \"  \" +\n              \"parameter is empty.\");\n    }\n  }\n\n  /**\n   * Get ACLs for a ZNode.\n   * @param path Path of the ZNode.\n   * @return The list of ACLs.\n   * @throws Exception If it cannot contact Zookeeper.\n   */\n  public List<ACL> getACL(final String path) throws Exception {\n    return curator.getACL().forPath(path);\n  }\n\n  /**\n   * Get the data in a ZNode.","sourceCodeStart":220,"sourceCodeEnd":256,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java#L220-L256","documentation":"The final check of validateSslConfiguration requires hadoop.zk.ssl.truststore.password to be non-empty. This gtest-era guard fails fast: without the truststore password the TLS handshake cannot proceed, so start() throws IOException instead of hanging later.","triggerScenarios":"sslEnabled=true with hadoop.zk.ssl.truststore.password unset or empty; the password managed only on the server side; a credential provider path configured but the entry missing from the store.","commonSituations":"Rolling out ZooKeeper TLS where truststore passwords are provisioned inconsistently across nodes; secrets centralization projects that renamed the credential alias; config diffs where the trailing property of the SSL block was dropped.","solutions":["Set hadoop.zk.ssl.truststore.password (ideally via the Hadoop credential provider rather than plaintext XML)","If the alias lives in a JCEKS store, verify with hadoop credential list -provider ... that hadoop.zk.ssl.truststore.password exists there and hadoop.security.credential.provider.path is set","Re-check conf.get(\"hadoop.zk.ssl.truststore.password\") in the failing JVM"],"exampleFix":"<!-- before: truststore.password missing while truststore.location set -->\n<!-- after -->\n<property>\n  <name>hadoop.zk.ssl.truststore.password</name>\n  <value>from-credential-provider-or-truststore-pass</value>\n</property>","handlingStrategy":"validation","validationCode":"String pw = conf.get(\"hadoop.zk.ssl.truststore.password\");\nif (pw == null || pw.isEmpty()) {\n  throw new IllegalStateException(\"hadoop.zk.ssl.truststore.password is required when SSL is enabled\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  zkManager.start(authInfos, true, null);\n} catch (IOException e) {\n  LOG.error(\"ZK SSL config incomplete: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Provision all four SSL properties symmetrically; the last one is the most often forgotten","Use the credential provider for both passwords and test alias resolution before restart","Diff old vs new core-site.xml on TLS changes so trailing properties are not dropped"],"tags":["hadoop","zookeeper","ssl","tls","truststore","secrets","configuration","java"],"backgroundTag":"missing-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}