{"record":{"id":"afc98e3ee2b87ab0","repo":"apache/hadoop","slug":"certificate-exception-storing-keystore","errorCode":null,"errorMessage":"Certificate exception storing keystore {}","messagePattern":"Certificate exception storing keystore (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":299,"sourceCode":"  }\n\n  @Override\n  public void flush() throws IOException {\n    writeLock.lock();\n    try {\n      if (!changed) {\n        LOG.debug(\"Keystore hasn't changed, returning.\");\n        return;\n      }\n      LOG.debug(\"Writing out keystore.\");\n      try (OutputStream out = getOutputStreamForKeystore()) {\n        keyStore.store(out, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't store keystore \" + this, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"No such algorithm storing keystore \" + this, e);\n      } catch (CertificateException e) {\n        throw new IOException(\"Certificate exception storing keystore \" + this,\n            e);\n      }\n      changed = false;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  /**\n   * Open up and initialize the keyStore.\n   *\n   * @throws IOException If there is a problem reading the password file\n   * or a problem reading the keystore.\n   */\n  private void locateKeystore() throws IOException {\n    try {\n      password = ProviderUtils.locatePassword(CREDENTIAL_PASSWORD_ENV_VAR,\n          conf.get(CREDENTIAL_PASSWORD_FILE_KEY));","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L281-L317","documentation":"flush() got a CertificateException from KeyStore.store(): an entry in the store carries certificate material that cannot be encoded when persisting. Pure Hadoop credential entries are SecretKeySpecs and never hit this, so it means the keystore also holds certificate entries (added by keytool or another tool) that this JVM/provider cannot encode.","triggerScenarios":"A .jceks file shared with keytool certificate operations; certificates written by a different JDK/provider version whose encoding the current one rejects; corrupted certificate entry in the store.","commonSituations":"Reusing one keystore file for both TLS certs and Hadoop credentials; certificate renewed with a newer keytool and encoded with parameters the old reader's JVM cannot handle.","solutions":["Inspect the mixed content: keytool -list -v -keystore <file> -storetype jceks","Split concerns: keep certificates in their own store; recreate a clean credentials-only JCEKS via hadoop credential","Encode/flush on the newest JVM that wrote the certificates, or upgrade the reading JVM to match"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-flight: confirm the store holds only secret-key entries before flush\nclass Probe {\n  static boolean onlySecretEntries(KeyStore ks) throws KeyStoreException {\n    java.util.Enumeration<String> e = ks.aliases();\n    while (e.hasMoreElements()) {\n      if (ks.isCertificateEntry(e.nextElement())) return false;\n    }\n    return true;\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.flush();\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.cert.CertificateException) {\n    // mixed-in certificates cannot be encoded by this JVM;\n    // split certs into a separate store and keep this one secrets-only\n  } else { throw ex; }\n}","preventionTips":["Dedicate one keystore to Hadoop credentials; never import certificates into it","When both must live on a host, use separate files and separate provider paths"],"tags":["hadoop","credential-provider","keystore","certificate","flush","jceks"],"backgroundTag":"certificate-encoding-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}