{"record":{"id":"71aad09aa7b2610a","repo":"t8y2/dbx","slug":"hive-two-way-tls-requires-ssltruststore-or-a-ca-ce","errorCode":null,"errorMessage":"Hive two-way TLS requires sslTrustStore or a CA certificate","messagePattern":"Hive two-way TLS requires sslTrustStore or a CA certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1113,"sourceCode":"\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc parameterBool(values map[string]string, key string) bool {\n\treturn booleanValue(parameter(values, key))\n}\n","sourceCodeStart":1095,"sourceCodeEnd":1131,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1095-L1131","documentation":"This error is thrown when Hive two-way TLS is enabled but the driver has no trust anchors: sslTrustStore is unset and config.RootCAs is nil. In mutual TLS the client must verify the server certificate against a CA pool; without a trust store the client cannot authenticate the server, so the driver rejects the config up front.","triggerScenarios":"Open/Connect with twoway=true while trustStoreLocation is empty and no CA certificate was loaded into config.RootCAs (e.g. sslTrustStore omitted, or its load failed and RootCAs stayed nil).","commonSituations":"Users add a client keystore for mutual TLS but forget the trust store; custom CA chains inside the corporate network are not provided; the trust store path/password is wrong so RootCAs ends up nil.","solutions":["Set sslTrustStore (and its password) in the connection config pointing to a keystore containing the server/CA certificates","Load the CA certificate pool into the TLS config so config.RootCAs is non-nil","If only one-way TLS is needed, drop the twoway parameter so the trust-store requirement no longer applies"],"exampleFix":"// before\ndsn := \"hive://user@hs2.example.com:10000/default?twoway=true&sslKeyStore=/etc/ssl/keystore.p12&sslKeyStorePassword=secret\"\n// after\ndsn := \"hive://user@hs2.example.com:10000/default?twoway=true&sslKeyStore=/etc/ssl/keystore.p12&sslKeyStorePassword=secret&sslTrustStore=/etc/ssl/truststore.p12&sslTrustStorePassword=secret\"","handlingStrategy":"validation","validationCode":"if strings.EqualFold(values[\"twoway\"], \"true\") && values[\"sslTrustStore\"] == \"\" {\n\treturn errors.New(\"twoway=true requires sslTrustStore (and password)\")\n}","typeGuard":"func hasTrustStore(values map[string]string) bool {\n\treturn values[\"sslTrustStore\"] != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always supply sslTrustStore and sslTrustStorePassword when twoway=true","Keep the trust store containing your Hive server/CA chain next to the keystore and version-control their paths in config templates","Validate both stores load with keytool -list before deployment"],"tags":["tls","hive","configuration","ca-certificate"],"backgroundTag":"missing-ca-certificate","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}