{"record":{"id":"7922ac642b7c17af","repo":"t8y2/dbx","slug":"hive-two-way-tls-requires-ssltruststore-or-a-ca-ce-7922ac","errorCode":null,"errorMessage":"Hive two-way TLS requires sslTrustStore or a CA certificate","messagePattern":"Hive two-way TLS requires sslTrustStore or a CA certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1116,"sourceCode":"\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc parameterBool(values map[string]string, key string) bool {\n\treturn booleanValue(parameter(values, key))\n}\n","sourceCodeStart":1098,"sourceCodeEnd":1134,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1098-L1134","documentation":"With two-way TLS enabled, the client must also verify the server's certificate: the driver requires either an sslTrustStore or a CA certificate loaded into config.RootCAs. If both are missing there is no trust anchor for the mTLS handshake, so validation fails before connecting.","triggerScenarios":"Setting twoway=true while sslTrustStore is empty and no sslCACertificate was loaded (config.RootCAs is nil).","commonSituations":"Configuring client identity (keystore) but forgetting the trust store; self-managed clusters with private CA not shipped to clients; cleaning up 'legacy' TLS params and dropping the CA file reference.","solutions":["Set sslCACertificate to a PEM CA file (builds config.RootCAs).","Set sslTrustStore (with trustStorePassword) to supply trust anchors.","Remove twoway=true if one-way TLS is actually intended (system roots would then apply)."],"exampleFix":"// before\n// twoway=true, sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit\n// after\n// twoway=true, sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit, sslCACertificate=/etc/certs/ca.pem","handlingStrategy":"validation","validationCode":"if params[\"twoway\"] == \"true\" || params[\"twoway\"] == \"1\" {\n\tif params[\"ssltruststore\"] == \"\" && params[\"sslcacertificate\"] == \"\" {\n\t\treturn fmt.Errorf(\"two-way TLS needs sslTrustStore or a CA certificate\")\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always ship the cluster CA bundle with the client config","Pair trust store setup with any twoway flag changes in code review","Verify server trust chain with `openssl s_client -connect host:port -CAfile ca.pem`"],"tags":["tls","mutual-tls","certificates","config"],"backgroundTag":"mtls-trust-store-missing","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}