{"record":{"id":"a3c8f3221d65b8c6","repo":"apache/hadoop","slug":"can-t-load-keystore","errorCode":null,"errorMessage":"Can't load keystore {}","messagePattern":"Can't load keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":337,"sourceCode":"        password = CREDENTIAL_PASSWORD_DEFAULT.toCharArray();\n      }\n      KeyStore ks;\n      ks = KeyStore.getInstance(getKeyStoreType());\n      if (keystoreExists()) {\n        stashOriginalFilePermissions();\n        try (InputStream in = getInputStreamForFile()) {\n          ks.load(in, password);\n        }\n      } else {\n        createPermissions(\"600\");\n        // required to create an empty keystore. *sigh*\n        ks.load(null, password);\n      }\n      keyStore = ks;\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't create keystore\", e);\n    } catch (GeneralSecurityException e) {\n      throw new IOException(\"Can't load keystore \" + getPathAsString(), e);\n    }\n  }\n\n  @Override\n  public boolean needsPassword() throws IOException {\n    return (null == ProviderUtils.locatePassword(CREDENTIAL_PASSWORD_ENV_VAR,\n        conf.get(CREDENTIAL_PASSWORD_FILE_KEY)));\n\n  }\n\n  @Override\n  public String noPasswordWarning() {\n    return ProviderUtils.noPasswordWarning(CREDENTIAL_PASSWORD_ENV_VAR,\n            CREDENTIAL_PASSWORD_FILE_KEY);\n  }\n\n  @Override\n  public String noPasswordError() {","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L319-L355","documentation":"Thrown in locateKeystore() when ks.load() raises a GeneralSecurityException while reading the store file: a CertificateException (file bytes are not a valid keystore encoding - corrupt/truncated/not a keystore) or NoSuchAlgorithmException (integrity-check algorithm unavailable). Note: a WRONG PASSWORD during load surfaces as a raw 'Keystore was tampered with, or password was incorrect' IOException from the JDK, not as this message.","triggerScenarios":"Opening a jceks:// or localjceks:// provider whose file is truncated (crashed writer), binary garbage, or a non-keystore file that happens to sit at the path; JVM missing the algorithm used for the store's integrity check.","commonSituations":"Keystore file half-written after a node crash or full disk; someone edited/sed'd the binary file; a symlink points at a placeholder file; store created on newer Java then read on an old JVM.","solutions":["Check the file: size > 0 and readable, then keytool -list -keystore <file> -storetype jceks","Restore from backup or recreate the store at a fresh path and re-add credentials","If keytool loads it fine, align the JVM/provider set between the tool that validates and the Hadoop process (algorithm availability)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-flight: prove the file loads as JCEKS with the intended password\nstatic void assertLoadableJceks(java.nio.file.Path file, char[] pw) throws Exception {\n  KeyStore ks = KeyStore.getInstance(\"jceks\");\n  try (InputStream in = Files.newInputStream(file)) {\n    ks.load(in, pw);   // wrong password -> 'Keystore was tampered' IOException\n  }                 // garbage bytes  -> CertificateException\n}","typeGuard":null,"tryCatchPattern":"try {\n  CredentialProviderFactory.getProviders(conf);\n} catch (IOException ex) {\n  if (ex.getMessage() != null && ex.getMessage().contains(\"Can't load keystore\")) {\n    // file corrupt or algorithm unavailable: restore backup / align JVM; not retryable as-is\n  } else { throw ex; }\n}","preventionTips":["Keep backups of every .jceks file (they are small) - corruption has no repair path","Use atomic moves when provisioning store files; never write them in place from scripts","Pin the same Java major version on store writers and readers"],"tags":["hadoop","credential-provider","keystore","corrupt-file","load","jceks"],"backgroundTag":"keystore-load-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}