{"record":{"id":"3d2cf75c66b4829d","repo":"apache/hadoop","slug":"invalid-hostname-verifier","errorCode":null,"errorMessage":"Invalid hostname verifier: {}","messagePattern":"Invalid hostname verifier: (.+?)","errorType":"validation","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java","lineNumber":234,"sourceCode":"    return getHostnameVerifier(StringUtils.toUpperCase(\n        conf.get(SSL_HOSTNAME_VERIFIER_KEY, \"DEFAULT\").trim()));\n  }\n\n  public static HostnameVerifier getHostnameVerifier(String verifier)\n    throws GeneralSecurityException, IOException {\n    HostnameVerifier hostnameVerifier;\n    if (verifier.equals(\"DEFAULT\")) {\n      hostnameVerifier = SSLHostnameVerifier.DEFAULT;\n    } else if (verifier.equals(\"DEFAULT_AND_LOCALHOST\")) {\n      hostnameVerifier = SSLHostnameVerifier.DEFAULT_AND_LOCALHOST;\n    } else if (verifier.equals(\"STRICT\")) {\n      hostnameVerifier = SSLHostnameVerifier.STRICT;\n    } else if (verifier.equals(\"STRICT_IE6\")) {\n      hostnameVerifier = SSLHostnameVerifier.STRICT_IE6;\n    } else if (verifier.equals(\"ALLOW_ALL\")) {\n      hostnameVerifier = SSLHostnameVerifier.ALLOW_ALL;\n    } else {\n      throw new GeneralSecurityException(\"Invalid hostname verifier: \" +\n                                         verifier);\n    }\n    return hostnameVerifier;\n  }\n\n  /**\n   * Releases any resources being used.\n   */\n  public void destroy() {\n    keystoresFactory.destroy();\n  }\n  /**\n   * Returns the SSLFactory KeyStoresFactory instance.\n   *\n   * @return the SSLFactory KeyStoresFactory instance.\n   */\n  public KeyStoresFactory getKeystoresFactory() {\n    return keystoresFactory;","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java#L216-L252","documentation":"SSLFactory reads hadoop.ssl.hostname.verifier from the SSL configuration and accepts exactly five values: DEFAULT, DEFAULT_AND_LOCALHOST, STRICT, STRICT_IE6, ALLOW_ALL. Any other string makes getHostnameVerifier throw GeneralSecurityException during SSLFactory initialization.","triggerScenarios":"Setting hadoop.ssl.hostname.verifier to an unsupported value in ssl-server.xml/ssl-client.xml — lowercase 'allow_all', 'strict-ietf', or a fully-qualified class name (this Hadoop version does not support class names here).","commonSituations":"Copy/paste from older docs or other projects; attempts to plug a custom HostnameVerifier; case-sensitive values entered lowercase.","solutions":["Use one of the exact uppercase values: DEFAULT, DEFAULT_AND_LOCALHOST, STRICT, STRICT_IE6, ALLOW_ALL","Remove the property to fall back to the default verifier if you do not need a special mode","Keep STRICT (or DEFAULT) in production; use ALLOW_ALL only in test environments"],"exampleFix":"<!-- before -->\n<property>\n  <name>hadoop.ssl.hostname.verifier</name>\n  <value>allow_all</value>\n</property>\n\n<!-- after -->\n<property>\n  <name>hadoop.ssl.hostname.verifier</name>\n  <value>DEFAULT</value>\n</property>","handlingStrategy":"validation","validationCode":"private static final Set<String> VALID_VERIFIERS = new HashSet<>(Arrays.asList(\n    \"DEFAULT\", \"DEFAULT_AND_LOCALHOST\", \"STRICT\", \"STRICT_IE6\", \"ALLOW_ALL\"));\n\nString verifier = sslConf.get(\"hadoop.ssl.hostname.verifier\", \"DEFAULT\").trim().toUpperCase(Locale.ROOT);\nif (!VALID_VERIFIERS.contains(verifier)) {\n  throw new IllegalStateException(\n      \"Invalid hadoop.ssl.hostname.verifier: \" + verifier\n      + \"; allowed: \" + VALID_VERIFIERS);\n}","typeGuard":null,"tryCatchPattern":"try {\n  factory = new SSLFactory(mode, conf);\n} catch (GeneralSecurityException e) {\n  if (e.getMessage().startsWith(\"Invalid hostname verifier\")) {\n    throw new IllegalStateException(\"Fix hadoop.ssl.hostname.verifier in ssl config\", e);\n  }\n  throw e;\n}","preventionTips":["Copy verifier values from the current Hadoop SSL documentation, in exact uppercase","Validate SSL config files in CI against the allowed set","Avoid ALLOW_ALL outside test clusters — it disables hostname verification"],"tags":["ssl","tls","hostname-verification","configuration","hadoop"],"backgroundTag":"invalid-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}