{"record":{"id":"6fd9438e1a004304","repo":"apache/hadoop","slug":"the-ssl-encryption-is-enabled-for-the-component-s-6fd943","errorCode":null,"errorMessage":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop.zk.ssl.keystore.password parameter is empty.","messagePattern":"The SSL encryption is enabled for the component's ZooKeeper client connection, however the hadoop\\.zk\\.ssl\\.keystore\\.password parameter is empty\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java","lineNumber":226,"sourceCode":"                conf.get(CommonConfigurationKeys.ZK_KERBEROS_KEYTAB), sslEnabled,\n                new TruststoreKeystore(conf))).zkClientConfig(zkClientConfig)\n        .sessionTimeoutMs(zkSessionTimeout).retryPolicy(retryPolicy)\n        .authorization(authInfos).build();\n    client.start();\n\n    this.curator = client;\n  }\n  /* Check on SSL/TLS client connection requirements to emit the name of the\n   configuration missing. It improves supportability. */\n  private void validateSslConfiguration(Configuration config) throws IOException {\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's \" + \"ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_KEYSTORE_PASSWORD + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_LOCATION + \" \" +\n              \"parameter is empty.\");\n    }\n    if (StringUtils.isEmpty(config.get(CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD))) {\n      throw new IOException(\n          \"The SSL encryption is enabled for the component's ZooKeeper client connection, \"\n              + \"however the \" + CommonConfigurationKeys.ZK_SSL_TRUSTSTORE_PASSWORD + \"  \" +\n              \"parameter is empty.\");\n    }\n  }\n","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/curator/ZKCuratorManager.java#L208-L244","documentation":"validateSslConfiguration next requires hadoop.zk.ssl.keystore.password, the password protecting the keystore whose location was just checked. A missing or empty value throws IOException with this message before any connection attempt, so the failure is configuration, not network.","triggerScenarios":"sslEnabled=true with hadoop.zk.ssl.keystore.password unset or empty; the password stored only under a differently spelled key; an XML quoting/CDATA mistake leaving the value blank.","commonSituations":"Enabling ZooKeeper TLS where the runbook documents the keystore but not its password key; secrets moved to a vault or credential provider that is not wired into Configuration; values copied from documentation with stray quotes or whitespace.","solutions":["Set hadoop.zk.ssl.keystore.password in core-site.xml","Better: keep it out of XML with the Hadoop credential provider (hadoop credential create hadoop.zk.ssl.keystore.password -provider jceks://file/..., plus hadoop.security.credential.provider.path) - Configuration resolves it transparently","Re-check conf.get(\"hadoop.zk.ssl.keystore.password\") in the failing JVM"],"exampleFix":"<!-- before: password key missing while sslEnabled=true -->\n<!-- after -->\n<property>\n  <name>hadoop.zk.ssl.keystore.password</name>\n  <value>from-credential-provider-or-keystore-pass</value>\n</property>\n<!-- preferred: hadoop credential create hadoop.zk.ssl.keystore.password -provider jceks://file/etc/security/zk/secrets.jceks -->","handlingStrategy":"validation","validationCode":"String pw = conf.get(\"hadoop.zk.ssl.keystore.password\");\nif (pw == null || pw.isEmpty()) {\n  throw new IllegalStateException(\"hadoop.zk.ssl.keystore.password is required when SSL is enabled\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  zkManager.start(authInfos, true, null);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"keystore.password\")) {\n    // config problem, not connectivity: fail with actionable text\n    throw new ServiceConfigurationException(e.getMessage(), e);\n  }\n  throw e;\n}","preventionTips":["Keep SSL secrets in the Hadoop credential provider (JCEKS) instead of XML","Verify credential aliases with hadoop credential list before rollout","Never leave placeholder values like CHANGEIT in templates that gate startup checks"],"tags":["hadoop","zookeeper","ssl","tls","keystore","secrets","configuration","java"],"backgroundTag":"missing-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}