{"record":{"id":"8579896f3a7cc7e7","repo":"apache/hadoop","slug":"can-t-get-algorithm-for-name-from-keystore-pa","errorCode":null,"errorMessage":"Can't get algorithm for ${name} from keystore ${path}","messagePattern":"Can't get algorithm for (.+?) from keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":422,"sourceCode":"      if (cache.containsKey(name)) {\n        return cache.get(name);\n      }\n      try {\n        if (!keyStore.containsAlias(name)) {\n          return null;\n        }\n        Metadata meta = ((KeyMetadata) keyStore.getKey(name, password)).metadata;\n        cache.put(name, meta);\n        return meta;\n      } catch (ClassCastException e) {\n        throw new IOException(\"Can't cast key for \" + name + \" in keystore \" +\n            path + \" to a KeyMetadata. Key may have been added using \" +\n            \" keytool or some other non-Hadoop method.\", e);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get metadata for \" + name +\n            \" from keystore \" + path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for \" + name +\n            \" from keystore \" + path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key for \" + name +\n            \" from keystore \" + path, e);\n      }\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public KeyVersion createKey(String name, byte[] material,\n                               Options options) throws IOException {\n    Preconditions.checkArgument(name.equals(StringUtils.toLowerCase(name)),\n        \"Uppercase key names are unsupported: %s\", name);\n    writeLock.lock();\n    try {\n      try {","sourceCodeStart":404,"sourceCodeEnd":440,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L404-L440","documentation":"In getMetadata(), getKey() threw NoSuchAlgorithmException: the algorithm protecting the metadata entry in the keystore is unavailable in the current JVM's JCE providers. The message names the key and keystore path.","triggerScenarios":"Metadata lookup on a keystore whose entries were protected with an algorithm the runtime JDK lacks — keystore written under a different JDK/vendor, or a restricted-JCE runtime reading stronger protection algorithms.","commonSituations":"JDK downgrades or vendor swaps on KMS hosts; very old Java 8 builds before unlimited-strength defaults; keystores produced by other tools with non-default entry protection","solutions":["Run KMS on a current JDK (8u161+ or 11+) where unlimited-strength JCE is default","Recreate or re-save the keystore under the target JDK so entries use available protection algorithms","Inspect the nested cause for the missing algorithm name and verify the SunJCE provider is active"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm the JVM can read every entry before going live\nKeyStore ks = KeyStore.getInstance(\"jceks\");\nks.load(in, pwd);\nfor (Enumeration<String> a = ks.aliases(); a.hasMoreElements();) {\n  ks.getKey(a.nextElement(), pwd); // surfaces unavailable algorithms now\n}","typeGuard":null,"tryCatchPattern":"try {\n  meta = provider.getMetadata(name);\n} catch (IOException e) {\n  if (e.getCause() instanceof NoSuchAlgorithmException) {\n    // JDK lacks the protection algorithm: upgrade JDK and re-save the keystore\n  }\n}","preventionTips":["Pin the KMS JDK family and version across hosts","Re-save keystores when moving between major JDK versions","Check nested causes — the algorithm name tells you exactly what is missing"],"tags":["keystore","kms","crypto","jce","algorithm-unavailable"],"backgroundTag":"keystore-algorithm-unavailable","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}