{"record":{"id":"820fe1100d16a646","repo":"apache/hadoop","slug":"can-t-create-keystore-e","errorCode":null,"errorMessage":"Can't create keystore: ${e}","messagePattern":"Can't create keystore: (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":172,"sourceCode":"      keyStore = KeyStore.getInstance(SCHEME_NAME);\n      FsPermission perm = null;\n      if (fs.exists(path)) {\n        // flush did not proceed to completion\n        // _NEW should not exist\n        if (fs.exists(newPath)) {\n          throw new IOException(\n              String.format(\"Keystore not loaded due to some inconsistency \"\n              + \"('%s' and '%s' should not exist together)!!\", path, newPath));\n        }\n        perm = tryLoadFromPath(path, oldPath);\n      } else {\n        perm = tryLoadIncompleteFlush(oldPath, newPath);\n      }\n      // Need to save off permissions in case we need to\n      // rewrite the keystore in flush()\n      permissions = perm;\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't create keystore: \" + e, e);\n    } catch (GeneralSecurityException e) {\n      throw new IOException(\"Can't load keystore \" + path + \" : \" + e , e);\n    }\n  }\n\n  /**\n   * Try loading from the user specified path, else load from the backup\n   * path in case Exception is not due to bad/wrong password.\n   * @param path Actual path to load from\n   * @param backupPath Backup path (_OLD)\n   * @return The permissions of the loaded file\n   * @throws NoSuchAlgorithmException\n   * @throws CertificateException\n   * @throws IOException\n   */\n  private FsPermission tryLoadFromPath(Path path, Path backupPath)\n      throws NoSuchAlgorithmException, CertificateException,\n      IOException {","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L154-L190","documentation":"While loading the key store file, KeyStore.getInstance(SCHEME_NAME) (the JCEKS keystore type) or subsequent setup threw a KeyStoreException — the JVM's security provider could not create the keystore object itself. JavaKeyStoreProvider wraps it as IOException(\"Can't create keystore\") with the original cause attached.","triggerScenarios":"The JCE security provider cannot instantiate a 'jceks' KeyStore — e.g. a broken/limited JDK runtime, a security provider misconfiguration, or a JDK that does not expose the JCEKS type. Distinguished from load failures (wrong password/corrupt file), which surface as GeneralSecurityException instead.","commonSituations":"Running KMS on an unsupported or stripped-down JRE; custom java.security files that removed the SunJCE provider; JDK upgrades or vendor JDKs with provider differences","solutions":["Run KMS on a fully supported JDK distribution (e.g. Adoptium/OpenJDK) — do not use cut-down JRE builds","Inspect $JAVA_HOME/conf/security/java.security and confirm the SunJCE provider is registered","Verify the JVM can create the keystore type: keytool -list on any jceks file, or a one-line KeyStore.getInstance(\"jceks\") smoke test","Check the nested cause in the log for the exact provider error"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Smoke-test the JVM can create a JCEKS keystore before starting KMS\ntry {\n  java.security.KeyStore.getInstance(\"jceks\");\n} catch (java.security.KeyStoreException e) {\n  throw new IllegalStateException(\"JVM cannot create JCEKS keystores: \" + e); \n}","typeGuard":null,"tryCatchPattern":"try {\n  provider = new JavaKeyStoreProvider(uri, conf);\n} catch (IOException e) {\n  LOG.error(\"Keystore init failed on this JVM: {}\", e.getMessage(), e.getCause());\n  // inspect cause for KeyStoreException -> JDK/provider problem, not data problem\n}","preventionTips":["Standardize KMS hosts on a full supported JDK distribution","Review java.security provider files after JDK upgrades","Distinguish creation failures (provider issue) from load failures (password/data) before debugging"],"tags":["keystore","kms","jce","crypto","jvm-provider"],"backgroundTag":"keystore-initialization-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}