{"record":{"id":"93795038f02c5874","repo":"t8y2/dbx","slug":"hive-two-way-tls-requires-sslkeystore-or-a-client-937950","errorCode":null,"errorMessage":"Hive two-way TLS requires sslKeyStore or a client certificate","messagePattern":"Hive two-way TLS requires sslKeyStore or a client certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1113,"sourceCode":"\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}\n\tif parameterBool(values, \"twoway\") {\n\t\tif keyStoreLocation == \"\" && len(config.Certificates) == 0 {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslKeyStore or a client certificate\")\n\t\t}\n\t\tif trustStoreLocation == \"\" && config.RootCAs == nil {\n\t\t\treturn nil, errors.New(\"Hive two-way TLS requires sslTrustStore or a CA certificate\")\n\t\t}\n\t}\n\treturn config, nil\n}\n\nfunc parameter(values map[string]string, key string) string {\n\tfor candidate, value := range values {\n\t\tif strings.EqualFold(strings.TrimSpace(candidate), key) {\n\t\t\treturn strings.TrimSpace(value)\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc parameterBool(values map[string]string, key string) bool {","sourceCodeStart":1095,"sourceCodeEnd":1131,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1095-L1131","documentation":"With two-way (mutual) TLS enabled via the 'twoway' parameter, the driver requires a client identity: either an sslKeyStore or a client certificate loaded into config.Certificates. If both are absent, the client would present no certificate and the server-side mTLS handshake would fail, so validation fails early.","triggerScenarios":"Setting twoway=true while sslKeyStore is empty, no sslKeyStore loaded, and no ClientCertPath/ClientKeyPath pair provided.","commonSituations":"Enabling mTLS on the server but only configuring the trust store (CA) on the client; forgetting the client certificate after turning on 'twoway' to debug server-cert issues; stripped-down config templates omitting client credentials.","solutions":["Set ClientCertPath and ClientKeyPath to the client cert/key pair.","Set sslKeyStore (with keystorepassword) to supply a client identity.","Remove twoway=true if the server does not actually require client certificates."],"exampleFix":"// before\n// twoway=true, sslTrustStore=/etc/certs/ca.pem\n// after\n// twoway=true, sslTrustStore=/etc/certs/ca.pem, ClientCertPath=/etc/certs/client.pem, ClientKeyPath=/etc/certs/client.key","handlingStrategy":"validation","validationCode":"if params[\"twoway\"] == \"true\" || params[\"twoway\"] == \"1\" {\n\tif params[\"sslkeystore\"] == \"\" && params.ClientCertPath == \"\" {\n\t\treturn fmt.Errorf(\"two-way TLS needs sslKeyStore or a client certificate\")\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When enabling twoway, configure all four pieces: client identity, key password, trust store, CA","Template mTLS configs as one unit to avoid partial setups","Test the handshake with openssl s_client before deploying"],"tags":["tls","mutual-tls","config"],"backgroundTag":"mtls-client-certificate-missing","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}