{"record":{"id":"4968b52bc107648f","repo":"apache/hadoop","slug":"can-t-load-keystore-path-e","errorCode":null,"errorMessage":"Can't load keystore ${path} : ${e}","messagePattern":"Can't load keystore (.+?) : (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":174,"sourceCode":"      if (fs.exists(path)) {\n        // flush did not proceed to completion\n        // _NEW should not exist\n        if (fs.exists(newPath)) {\n          throw new IOException(\n              String.format(\"Keystore not loaded due to some inconsistency \"\n              + \"('%s' and '%s' should not exist together)!!\", path, newPath));\n        }\n        perm = tryLoadFromPath(path, oldPath);\n      } else {\n        perm = tryLoadIncompleteFlush(oldPath, newPath);\n      }\n      // Need to save off permissions in case we need to\n      // rewrite the keystore in flush()\n      permissions = perm;\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't create keystore: \" + e, e);\n    } catch (GeneralSecurityException e) {\n      throw new IOException(\"Can't load keystore \" + path + \" : \" + e , e);\n    }\n  }\n\n  /**\n   * Try loading from the user specified path, else load from the backup\n   * path in case Exception is not due to bad/wrong password.\n   * @param path Actual path to load from\n   * @param backupPath Backup path (_OLD)\n   * @return The permissions of the loaded file\n   * @throws NoSuchAlgorithmException\n   * @throws CertificateException\n   * @throws IOException\n   */\n  private FsPermission tryLoadFromPath(Path path, Path backupPath)\n      throws NoSuchAlgorithmException, CertificateException,\n      IOException {\n    FsPermission perm = null;\n    try {","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L156-L192","documentation":"Loading the keystore file content threw a GeneralSecurityException (wrong password, unsupported algorithm while reading entries, or a malformed/unrecognized keystore file). The message includes the keystore path and the underlying exception.","triggerScenarios":"tryLoadFromPath/tryLoadIncompleteFlush call keyStore.load() and it fails: the stored password does not match the one supplied via KEYSTORE_PASSWORD_FILE_KEY (or the default), the file is corrupt, or the file is not actually a JCEKS keystore.","commonSituations":"Password file (hadoop.security.credential.provider.path keystore password file) out of sync with the keystore; keystore truncated by a disk issue; someone replaced the file with a PKCS12 keystore; JDK version change altering default keystore handling","solutions":["Check the password first: confirm the password file referenced by KEYSTORE_PASSWORD_FILE_KEY matches what keytool -list -keystore <path> -storetype jceks accepts","Verify integrity: keytool -list on the file; if unreadable, restore from the <path>_OLD backup or backups","Confirm the file is JCEKS and not another format — regenerate if the format was changed by keytool conversions","Read the nested cause in the KMS log — 'Given final block not properly padded' or 'keystore password was incorrect' points to password; 'Invalid keystore format' points to corruption"],"exampleFix":"# before: KMS log shows Can't load keystore /etc/security/keys/ks.jks\n\n# after: verify password and format\nkeytool -list -keystore /etc/security/keys/ks.jks -storetype jceks \\\n  -storepass:file /etc/security/keys/ks.password\n# if wrong password -> fix the password file referenced by\n#   hadoop.security.keystore.java.key.password... / KEYSTORE_PASSWORD_FILE_KEY","handlingStrategy":"validation","validationCode":"// Verify the keystore loads with the intended password before KMS start\nchar[] pwd = readFileTrimmed(passwordFile).toCharArray();\nKeyStore ks = KeyStore.getInstance(\"jceks\");\ntry (InputStream in = Files.newInputStream(keystorePath)) {\n  ks.load(in, pwd);\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.getKeys(); // forces load\n} catch (IOException e) {\n  Throwable c = e.getCause();\n  if (c instanceof GeneralSecurityException) {\n    // password or format problem: fix password file or restore keystore\n  }\n}","preventionTips":["Automate a keytool -list pre-flight with the same password file KMS uses","Trim password file content consistently; beware trailing newlines","Keep keystore format as jceks; avoid keytool conversions to PKCS12 on the KMS file"],"tags":["keystore","kms","crypto","password","corruption"],"backgroundTag":"keystore-load-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}