{"record":{"id":"e2435e22056ea744","repo":"apache/hadoop","slug":"no-crypto-protocol-versions-provided-by-the-client","errorCode":null,"errorMessage":"No crypto protocol versions provided by the client are supported. Client provided: {} NameNode supports: {}","messagePattern":"No crypto protocol versions provided by the client are supported\\. Client provided: (.+?) NameNode supports: (.+?)","errorType":"exception","errorClass":"UnknownCryptoProtocolVersionException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java","lineNumber":2746,"sourceCode":"      throws UnknownCryptoProtocolVersionException, UnresolvedLinkException,\n        SnapshotAccessControlException {\n    Preconditions.checkNotNull(zone);\n    Preconditions.checkNotNull(supportedVersions);\n    // Right now, we only support a single protocol version,\n    // so simply look for it in the list of provided options\n    final CryptoProtocolVersion required = zone.getVersion();\n\n    for (CryptoProtocolVersion c : supportedVersions) {\n      if (c.equals(CryptoProtocolVersion.UNKNOWN)) {\n        LOG.debug(\"Ignoring unknown CryptoProtocolVersion provided by client: {}\",\n            c.getUnknownValue());\n        continue;\n      }\n      if (c.equals(required)) {\n        return c;\n      }\n    }\n    throw new UnknownCryptoProtocolVersionException(\n        \"No crypto protocol versions provided by the client are supported.\"\n            + \" Client provided: \" + Arrays.toString(supportedVersions)\n            + \" NameNode supports: \" + Arrays.toString(CryptoProtocolVersion\n            .values()));\n  }\n\n  /**\n   * Create a new file entry in the namespace.\n   * \n   * For description of parameters and exceptions thrown see\n   * {@link ClientProtocol#create}, except it returns valid file status upon\n   * success\n   */\n  HdfsFileStatus startFile(String src, PermissionStatus permissions,\n      String holder, String clientMachine, EnumSet<CreateFlag> flag,\n      boolean createParent, short replication, long blockSize,\n      CryptoProtocolVersion[] supportedVersions, String ecPolicyName,\n      String storagePolicy, boolean logRetryCache) throws IOException {","sourceCodeStart":2728,"sourceCodeEnd":2764,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java#L2728-L2764","documentation":"For a create() inside an encryption zone the NameNode must agree with the client on a CryptoProtocolVersion, and it must equal the zone's recorded version. chooseProtocolVersion iterates the client-supplied supportedVersions (skipping UNKNOWN); if none equals the zone's required version it throws UnknownCryptoProtocolVersionException listing both the client's set and the server's supported values.","triggerScenarios":"A client whose DFSClient advertises crypto protocol versions that exclude the zone's version calls create/append on a path inside that encryption zone — e.g., an older client jar writing into a zone created by a newer Hadoop release with a higher protocol version.","commonSituations":"Mixed-version clusters during or after rolling upgrades; third-party apps pinned to an old hadoop-client writing into TDE zones; vendor-vs-Apache distro differences in CryptoProtocolVersion support.","solutions":["Run the client with the same or newer Hadoop version as the NameNode so its supported version list includes the zone's version","Inspect the zone (hdfs crypto -listZones / zone metadata) and, if legacy clients must keep writing, recreate the zone with a protocol version those clients support","Workaround: write outside the zone, then move data in with a version-matched client (distcp)"],"exampleFix":"# before: old client jar writing into a zone created by a newer NameNode\nhadoop jar app-old-deps.jar Writer /secure/data/file   # UnknownCryptoProtocolVersionException\n# after: run the same job with the cluster's Hadoop version on the classpath\nhadoop --config /etc/hadoop jar app.jar Writer /secure/data/file","handlingStrategy":"try-catch","validationCode":"EncryptionZone ez = ((DistributedFileSystem) fs).getEncryptionZoneForPath(path);\nif (ez != null) LOG.info(\"path is in EZ; zone crypto protocol version = {} — client must support it\", ez.getVersion());","typeGuard":null,"tryCatchPattern":"catch (UnknownCryptoProtocolVersionException e) { // client/server crypto-protocol skew: upgrade the client to the cluster version, or route the write through a version-matched client (distcp) }","preventionTips":["Pin client Hadoop versions to the cluster version on TDE deployments","During long rolling upgrades, keep zones on the lowest protocol version still needed"],"tags":["hdfs","encryption-zone","crypto-protocol","version-mismatch","tde"],"backgroundTag":"protocol-version-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}