{"record":{"id":"4a25ffd216e8b950","repo":"apache/hadoop","slug":"can-t-create-keystore","errorCode":null,"errorMessage":"Can't create keystore","messagePattern":"Can't create keystore","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":335,"sourceCode":"          conf.get(CREDENTIAL_PASSWORD_FILE_KEY));\n      if (password == null) {\n        password = CREDENTIAL_PASSWORD_DEFAULT.toCharArray();\n      }\n      KeyStore ks;\n      ks = KeyStore.getInstance(getKeyStoreType());\n      if (keystoreExists()) {\n        stashOriginalFilePermissions();\n        try (InputStream in = getInputStreamForFile()) {\n          ks.load(in, password);\n        }\n      } else {\n        createPermissions(\"600\");\n        // required to create an empty keystore. *sigh*\n        ks.load(null, password);\n      }\n      keyStore = ks;\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't create keystore\", e);\n    } catch (GeneralSecurityException e) {\n      throw new IOException(\"Can't load keystore \" + getPathAsString(), e);\n    }\n  }\n\n  @Override\n  public boolean needsPassword() throws IOException {\n    return (null == ProviderUtils.locatePassword(CREDENTIAL_PASSWORD_ENV_VAR,\n        conf.get(CREDENTIAL_PASSWORD_FILE_KEY)));\n\n  }\n\n  @Override\n  public String noPasswordWarning() {\n    return ProviderUtils.noPasswordWarning(CREDENTIAL_PASSWORD_ENV_VAR,\n            CREDENTIAL_PASSWORD_FILE_KEY);\n  }\n","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L317-L353","documentation":"In locateKeystore(), KeyStore.getInstance(...) for the provider's store type threw KeyStoreException, wrapped as 'Can't create keystore': the JVM has no security provider able to supply that keystore implementation (Hadoop's file providers use type 'jceks'). The store file was never even opened - this is a JVM capability failure.","triggerScenarios":"Constructing a jceks/localjceks provider on a JVM where the JCEKS KeyStore implementation is unavailable or disabled (FIPS/NSS-only JVM, stripped JRE, custom java.security with SunJCE removed); keystore.type overrides that break provider resolution.","commonSituations":"Hardened FIPS environments; minimal container JREs; java.security tampering; running the shell on an unsupported Java vendor.","solutions":["Use a full standard JDK and confirm SunJCE is listed: keytool -help should succeed; or print Security.getProviders()","Review $JAVA_HOME/lib/security/java.security (or java.security.properties overrides) and restore/remove overrides that strip providers","On FIPS JVMs, add a provider that implements the JCEKS store type before Hadoop starts"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Fail fast with a clear message if this JVM cannot open JCEKS stores at all\ntry {\n  KeyStore.getInstance(\"jceks\");\n} catch (java.security.KeyStoreException e) {\n  throw new IllegalStateException(\n      \"No JCEKS KeyStore implementation in this JVM - check java.security providers\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  List<CredentialProvider> ps = CredentialProviderFactory.getProviders(conf);\n} catch (IOException ex) {\n  if (ex.getMessage() != null && ex.getMessage().contains(\"Can't create keystore\")) {\n    // JVM capability problem: switch to a full JDK / fix provider list; not retryable\n  } else { throw ex; }\n}","preventionTips":["Smoke-test 'hadoop credential list -provider localjceks://file/tmp/probe.jceks' on every node class of JVM","Audit java.security.properties overrides and FIPS flags in hardened images"],"tags":["hadoop","credential-provider","keystore","jvm","fips","jceks"],"backgroundTag":"keystore-type-not-supported","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}