{"record":{"id":"83251ba3f8137137","repo":"t8y2/dbx","slug":"hive-two-way-tls-requires-sslkeystore-or-a-client","errorCode":null,"errorMessage":"Hive two-way TLS requires sslKeyStore or a client certificate","messagePattern":"Hive two-way TLS requires sslKeyStore or a client certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1110,"sourceCode":"\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc parameterBool(values map[string]string, key string) bool {","sourceCodeStart":1092,"sourceCodeEnd":1128,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1092-L1128","documentation":"This error is thrown when the Hive connection string enables two-way (mutual) TLS via the 'twoway' parameter but provides neither a keystore location nor a client certificate loaded into the TLS config. Mutual TLS requires the client to present a certificate to the server; without one the TLS handshake cannot succeed, so the driver fails fast at config time. It validates that either 'sslKeyStore' was supplied or certificates were already appended to config.Certificates.","triggerScenarios":"Calling the driver's Open/Connect with a connection config containing twoway=true (or twoway set truthy) while sslKeyStore is empty/missing and no client certificate was loaded from a keystore (keystore load failed silently or was skipped).","commonSituations":"Users enable Hive two-way SSL but forget sslKeyStorePassword so the keystore fails to load; users copy a one-way TLS URL and add twoway without adding client cert material; clusters switched to mutual TLS require client certs that were never provisioned.","solutions":["Set sslKeyStore (and sslKeyStorePassword) in the connection config pointing to a valid PKCS12/JKS keystore containing the client certificate","Provide a client certificate another way so config.Certificates is non-empty before the twoway check","If mutual TLS is not actually required by the server, remove the twoway parameter to use one-way TLS"],"exampleFix":"// before\ndsn := \"hive://user@hs2.example.com:10000/default?twoway=true&sslTrustStore=/etc/ssl/truststore.p12\"\n// after\ndsn := \"hive://user@hs2.example.com:10000/default?twoway=true&sslKeyStore=/etc/ssl/keystore.p12&sslKeyStorePassword=secret&sslTrustStore=/etc/ssl/truststore.p12\"","handlingStrategy":"validation","validationCode":"if strings.EqualFold(values[\"twoway\"], \"true\") && values[\"sslKeyStore\"] == \"\" {\n\treturn errors.New(\"twoway=true requires sslKeyStore (and password)\")\n}","typeGuard":"func hasClientCert(values map[string]string) bool {\n\treturn values[\"sslKeyStore\"] != \"\" || values[\"sslKeyStorePassword\"] != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always pair twoway=true with both sslKeyStore and sslKeyStorePassword","Verify the keystore file exists and is readable before connecting","Test the TLS handshake with openssl s_client -cert when provisioning new client certs"],"tags":["tls","hive","configuration","mutual-tls"],"backgroundTag":"missing-client-certificate","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}