{"record":{"id":"a4be1910449ad748","repo":"prestodb/presto","slug":"hive-metastore-initialize-ssl-error","errorCode":"HIVE_METASTORE_INITIALIZE_SSL_ERROR","errorMessage":"Hive metastore SSL initialization error: ${e}","messagePattern":"Hive metastore SSL initialization error: (.+?)","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"critical","filePath":"presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java","lineNumber":161,"sourceCode":"            }\n\n            // create TrustManagerFactory\n            final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n            trustManagerFactory.init(metastoreTrustStore);\n\n            // get X509TrustManager\n            final TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();\n            if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {\n                throw new RuntimeException(\"Expected exactly one X509TrustManager, but found:\" + Arrays.toString(trustManagers));\n            }\n\n            // create SSLContext\n            final SSLContext sslContext = SSLContext.getInstance(PROTOCOL);\n            sslContext.init(metastoreKeyManagers, trustManagers, null);\n            return Optional.of(sslContext);\n        }\n        catch (GeneralSecurityException | IOException e) {\n            throw new PrestoException(HIVE_METASTORE_INITIALIZE_SSL_ERROR, e);\n        }\n    }\n\n    /**\n     * Reads the truststore certificate and returns it\n     *\n     * @param trustStorePath\n     * @param trustStorePassword\n     * @throws IOException\n     * @throws GeneralSecurityException\n     */\n    private static KeyStore getTrustStore(File trustStorePath, Optional<String> trustStorePassword)\n            throws IOException, GeneralSecurityException\n    {\n        final KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n        try {\n            // attempt to read the trust store as a PEM file\n            final List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java#L143-L179","documentation":"buildSslContext wraps all GeneralSecurityException/IOException from TLS setup (loading key/trust stores, building managers, initializing SSLContext) in a PrestoException with code HIVE_METASTORE_INITIALIZE_SSL_ERROR. It signals that the configured SSL material for the metastore connection is unusable — wrong path, password, format, or algorithm.","triggerScenarios":"Enabling hive.metastore.thrift.ssl.enabled with a truststore/keystore path that does not exist, a wrong store password, an unsupported store type/algorithm, or unreadable files (permissions) — the underlying load()/init() throws and is wrapped here.","commonSituations":"Config deployment dropped the .jks file; password rotated but config not updated; file readable only by the hive service user, not the Presto process; TLS protocol disabled by java.security policy; PKCS12 vs JKS mismatch.","solutions":["Check that the keystore/truststore files exist at the configured paths and are readable by the Presto process user.","Verify store passwords (ssl.keystore.password / ssl.truststore.password) are correct and current.","Run keytool -list against both stores to confirm they open and use the right type (JKS/PKCS12).","Inspect the wrapped cause in the Presto log for the exact failure (NoSuchAlgorithmException, UnrecoverableKeyException, FileNotFoundException).","Ensure the configured TLS protocol is enabled in the JVM and files use PEM vs JKS consistently."],"exampleFix":"// before\nhive.metastore.thrift.ssl.enabled=true\nhive.metastore.thrift.ssl.keystore.password=oldpass   # rotated, now wrong\n// after\nhive.metastore.thrift.ssl.enabled=true\nhive.metastore.thrift.ssl.keystore.password=currentpass\n# and: chmod 640 /etc/presto/hive-metastore-client.jks (owned by presto user)","handlingStrategy":"try-catch","validationCode":"// preflight: load both stores exactly as the connector will\nchar[] pwd = storePassword.toCharArray();\nKeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (InputStream in = Files.newInputStream(Paths.get(keystorePath))) {\n    ks.load(in, pwd); // throws if path/password/format wrong\n}","typeGuard":null,"tryCatchPattern":"try {\n    HiveMetastoreClient client = clientFactory.create(metastoreUri, sslConfig...);\n} catch (PrestoException e) {\n    if (HiveErrorCode.HIVE_METASTORE_INITIALIZE_SSL_ERROR.toErrorCode().equals(e.getErrorCode())) {\n        LOG.error(\"Metastore SSL setup failed; check store paths/passwords: %s\", e.getCause());\n    } else {\n        throw e;\n    }\n}","preventionTips":["Prefer PEM files (PEM key/truststore options) to avoid JKS password/format pitfalls","Run a startup smoke test that opens both stores with configured passwords","Verify file ownership/permissions for the Presto service user","Keep SSL config and secrets rotation in lockstep; log only cause classes, not secrets","Confirm the configured TLS protocol is enabled in the JVM's java.security"],"tags":["ssl","tls","keystore","initialization","hive-metastore"],"backgroundTag":"ssl-initialization-failure","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}