{"record":{"id":"59a952ce2dc75189","repo":"apache/hadoop","slug":"the-property-has-not-been-set-in-the-ssl-conf","errorCode":null,"errorMessage":"The property '{}' has not been set in the ssl configuration file.","messagePattern":"The property '(.+?)' has not been set in the ssl configuration file\\.","errorType":"validation","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/FileBasedKeyStoresFactory.java","lineNumber":167,"sourceCode":"    trustManagers = new TrustManager[]{trustManager};\n  }\n\n  /**\n   * Implements logic of initializing the KeyManagers with the options\n   * to reload keystores.\n   * @param mode client or server\n   * @param keystoreType The keystore type.\n   * @param storesReloadInterval The interval to check if the keystore certificates\n   *                             file has changed.\n   */\n  private void createKeyManagersFromConfiguration(SSLFactory.Mode mode,\n                                                  String keystoreType, long storesReloadInterval)\n      throws GeneralSecurityException, IOException {\n    String locationProperty =\n        resolvePropertyName(mode, SSL_KEYSTORE_LOCATION_TPL_KEY);\n    String keystoreLocation = conf.get(locationProperty, \"\");\n    if (keystoreLocation.isEmpty()) {\n      throw new GeneralSecurityException(\"The property '\" + locationProperty +\n          \"' has not been set in the ssl configuration file.\");\n    }\n    String passwordProperty =\n        resolvePropertyName(mode, SSL_KEYSTORE_PASSWORD_TPL_KEY);\n    String keystorePassword = getPassword(conf, passwordProperty, \"\");\n    if (keystorePassword.isEmpty()) {\n      throw new GeneralSecurityException(\"The property '\" + passwordProperty +\n          \"' has not been set in the ssl configuration file.\");\n    }\n    String keyPasswordProperty =\n        resolvePropertyName(mode, SSL_KEYSTORE_KEYPASSWORD_TPL_KEY);\n    // Key password defaults to the same value as store password for\n    // compatibility with legacy configurations that did not use a separate\n    // configuration property for key password.\n    String keystoreKeyPassword = getPassword(\n        conf, keyPasswordProperty, keystorePassword);\n    if (LOG.isDebugEnabled()) {\n      LOG.debug(mode.toString() + \" KeyStore: \" + keystoreLocation);","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/FileBasedKeyStoresFactory.java#L149-L185","documentation":"FileBasedKeyStoresFactory requires the keystore location property in the SSL configuration file; the key is resolved from the template ssl.<mode>.keystore.location, i.e. ssl.server.keystore.location or ssl.client.keystore.location in the file referenced by hadoop.ssl.server.conf / hadoop.ssl.client.conf (ssl-server.xml / ssl-client.xml by default). If the value is empty, init fails with this GeneralSecurityException.","triggerScenarios":"Creating an SSLFactory(Mode.SERVER, conf) (or a service that does: HTTPS HDFS, HttpFS, KMS, YARN timelineserver) where ssl-server.xml lacks ssl.server.keystore.location; pointing hadoop.ssl.server.conf at the wrong file; a typo'd property name.","commonSituations":"Enabling https.xml property (JCEKS password files need the CredentialProvider API so the raw property is non-empty); wrong conf variable (client vs server) after refactors.","solutions":["Set <name>ssl.server.keystore.location</name> (or ssl.client.keystore.location) in the ssl-server.xml/ssl-client.xml referenced by hadoop.ssl.server.conf/hadoop.ssl.client.conf","Verify the referenced file is actually the one being loaded: check the hadoop.ssl.*.conf property in core-site.xml and the file on the server's classpath","Confirm the path exists and is readable by the service user","If the password comes from a CredentialProvider, make sure the location property itself is still set literally; only the password may be indirected"],"exampleFix":"<!-- ssl-server.xml: before -->\n<!-- ssl.server.keystore.location missing -->\n\n<!-- after -->\n<property>\n  <name>ssl.server.keystore.location</name>\n  <value>/etc/security/tls/keystore.jks</value>\n</property>","handlingStrategy":"validation","validationCode":"String key = \"ssl.\" + (isServer ? \"server\" : \"client\") + \".keystore.location\";\nString location = sslConf.get(key, \"\");\nif (location.isEmpty() || !new File(location).canRead()) {\n  throw new IllegalStateException(key + \" missing or unreadable: \" + location);\n}\nSSLFactory factory = new SSLFactory(mode, conf);","typeGuard":null,"tryCatchPattern":"try {\n  factory = new SSLFactory(SSLFactory.Mode.SERVER, conf);\n} catch (GeneralSecurityException e) {\n  if (e.getMessage().contains(\"has not been set in the ssl configuration file\")) {\n    // fail startup with a precise ops message naming the missing property\n    throw new IllegalStateException(\"TLS config incomplete: \" + e.getMessage(), e);\n  }\n  throw e;\n}","preventionTips":["Add config smoke tests that assert all required ssl.*.keystore/truststore properties before deploy","Template ssl-server.xml in config management and alert when keys are removed","Confirm hadoop.ssl.server.conf / hadoop.ssl.client.conf point at the intended files on every host"],"tags":["ssl","tls","keystore","configuration","hadoop","ssl-server-xml"],"backgroundTag":"missing-config-property","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}