{"record":{"id":"75023af0e9cfc203","repo":"apache/hadoop","slug":"the-truststore-password-parameter-is-empty-for-the","errorCode":null,"errorMessage":"The truststore password parameter is empty for the ZooKeeper client connection.","messagePattern":"The truststore password parameter is empty for the ZooKeeper client connection\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":868,"sourceCode":"    }\n  }\n\n  public static void validateSslConfiguration(TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystoreLocation)) {\n      throw new ConfigurationException(\n          \"The keystore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.keystorePassword)) {\n      throw new ConfigurationException(\n          \"The keystore password parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststoreLocation)) {\n      throw new ConfigurationException(\n          \"The truststore location parameter is empty for the ZooKeeper client connection.\");\n    }\n    if (org.apache.commons.lang3.StringUtils.isEmpty(truststoreKeystore.truststorePassword)) {\n      throw new ConfigurationException(\n          \"The truststore password parameter is empty for the ZooKeeper client connection.\");\n    }\n  }\n\n  /**\n   * Configure ZooKeeper Client with SSL/TLS connection.\n   * @param zkClientConfig ZooKeeper Client configuration\n   * @param truststoreKeystore truststore keystore, that we use to set the SSL configurations\n   * @throws ConfigurationException if the SSL configs are empty\n   */\n  public static void setSslConfiguration(ZKClientConfig zkClientConfig,\n                                         TruststoreKeystore truststoreKeystore)\n          throws ConfigurationException {\n    setSslConfiguration(zkClientConfig, truststoreKeystore, new ClientX509Util());\n  }\n\n  public static void setSslConfiguration(ZKClientConfig zkClientConfig,\n                                         TruststoreKeystore truststoreKeystore,","sourceCodeStart":850,"sourceCodeEnd":886,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L850-L886","documentation":"The final check in SecurityUtil.validateSslConfiguration: the truststore password must be non-empty. All four SSL fields (keystore location/password, truststore location/password) must be present together; a blank truststore password fails validation with ConfigurationException before any TLS connection is attempted.","triggerScenarios":"ZK SSL configured with the other three fields set but the truststore password property unset or blank, commonly when the password was meant to come from a credential provider or environment substitution that produced an empty string.","commonSituations":"Secrets externalized but the alias missing; config templating that drops the last property; truststores created without passwords while the validator requires the field regardless.","solutions":["Set the zookeeper SSL truststore password property (zookeeper.ssl.truststore.password)","Verify credential-provider aliases resolve non-empty: hadoop credential list","Check the effective config shows all four SSL fields populated","Restart the daemon and watch for the SASL/TLS handshake to confirm the config is now complete"],"exampleFix":"<!-- before -->\n<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>\n\n<!-- after -->\n<property><name>zookeeper.ssl.truststore.location</name><value>/etc/zk/ssl/truststore.jks</value></property>\n<property><name>zookeeper.ssl.truststore.password</name><value>${zk-truststore-password}</value></property>","handlingStrategy":"validation","validationCode":"String tsPw = conf.get(\"zookeeper.ssl.truststore.password\");\nif (org.apache.commons.lang3.StringUtils.isEmpty(tsPw)) {\n  throw new ConfigurationException(\n      \"zookeeper.ssl.truststore.password is required when truststore.location is set\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair truststore location and password in one config unit","Use credential providers and verify alias resolution in deployment checks","Surface which of the four fields failed validation in startup errors"],"tags":["ssl","tls","zookeeper","configuration","password"],"backgroundTag":"incomplete-ssl-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}