{"record":{"id":"4deaf852424c9dfb","repo":"apache/hadoop","slug":"no-such-algorithm-storing-keystore-this","errorCode":null,"errorMessage":"No such algorithm storing keystore ${this}","messagePattern":"No such algorithm storing keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":614,"sourceCode":"      LOG.debug(\"Could not reset Keystore to previous state\", e);\n    }\n  }\n\n  private void cleanupNewAndOld(Path newPath, Path oldPath) throws IOException {\n    // Rename _NEW to CURRENT\n    renameOrFail(newPath, path);\n    // Delete _OLD\n    fs.delete(oldPath, true);\n  }\n\n  protected void writeToNew(Path newPath) throws IOException {\n    try (FSDataOutputStream out =\n        FileSystem.create(fs, newPath, permissions);) {\n      keyStore.store(out, password);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store keystore \" + this, e);\n    } catch (NoSuchAlgorithmException e) {\n      throw new IOException(\n          \"No such algorithm storing keystore \" + this, e);\n    } catch (CertificateException e) {\n      throw new IOException(\n          \"Certificate exception storing keystore \" + this, e);\n    }\n  }\n\n  protected boolean backupToOld(Path oldPath)\n      throws IOException {\n    try {\n      renameOrFail(path, oldPath);\n      return true;\n    } catch (FileNotFoundException e) {\n      return false;\n    }\n  }\n\n  private void revertFromOld(Path oldPath, boolean fileExisted)","sourceCodeStart":596,"sourceCodeEnd":632,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L596-L632","documentation":"KeyStore.store() computes an integrity MAC over the keystore (classically HmacSHA1 for JCEKS); NoSuchAlgorithmException means the JVM's configured security providers cannot supply that algorithm in the current environment. This is a JVM security-configuration problem, not a keystore-content problem.","triggerScenarios":"FIPS-restricted JVM where the MAC algorithm is unavailable or disabled; a custom java.security that removed SunJCE; an old or stripped JDK distribution missing the algorithm.","commonSituations":"Hardened FIPS environments; security-manager restricted runtimes; docker images built on minimal JDKs with pruned providers.","solutions":["Run with a full-strength standard provider set: restore the default java.security / include SunJCE","Probe at startup: Mac.getInstance(\"HmacSHA1\") and KeyStore.getInstance(\"jceks\") to fail fast with a clear cause","In restricted environments, switch to a KMS-backed provider instead of local JCEKS files"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// startup probe: fail fast with a clear message in restricted JVMs\ntry {\n  javax.crypto.Mac.getInstance(\"HmacSHA1\");\n  java.security.KeyStore.getInstance(\"jceks\");\n} catch (java.security.NoSuchAlgorithmException | java.security.KeyStoreException e) {\n  throw new IllegalStateException(\"JCE providers incomplete: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try { provider.flush(); } catch (IOException e) { if (e.getCause() instanceof java.security.NoSuchAlgorithmException) { // environment fault: fix JVM security providers or move to KMS provider; retrying unchanged will fail } throw e; }","preventionTips":["Validate JCE provider availability at deployment, not at first flush","Pin a standard JDK with unmodified java.security for keystore hosts","In FIPS environments prefer KMS-backed providers over local JCEKS"],"tags":["java","hadoop","keystore","jce","fips","security-provider"],"backgroundTag":"jce-algorithm-unavailable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}