{"record":{"id":"e28280f6837bea2a","repo":"apache/hadoop","slug":"no-such-algorithm-storing-keystore-this-e28280","errorCode":null,"errorMessage":"No such algorithm storing keystore \" + this","messagePattern":"No such algorithm storing keystore \" \\+ this","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java","lineNumber":297,"sourceCode":"    changed = true;\n    return new CredentialEntry(alias, material);\n  }\n\n  @Override\n  public void flush() throws IOException {\n    writeLock.lock();\n    try {\n      if (!changed) {\n        LOG.debug(\"Keystore hasn't changed, returning.\");\n        return;\n      }\n      LOG.debug(\"Writing out keystore.\");\n      try (OutputStream out = getOutputStreamForKeystore()) {\n        keyStore.store(out, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't store keystore \" + this, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"No such algorithm storing keystore \" + this, e);\n      } catch (CertificateException e) {\n        throw new IOException(\"Certificate exception storing keystore \" + this,\n            e);\n      }\n      changed = false;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  /**\n   * Open up and initialize the keyStore.\n   *\n   * @throws IOException If there is a problem reading the password file\n   * or a problem reading the keystore.\n   */\n  private void locateKeystore() throws IOException {\n    try {","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/AbstractJavaKeyStoreProvider.java#L279-L315","documentation":"During flush(), KeyStore.store() threw NoSuchAlgorithmException: the JVM cannot supply the integrity/protection algorithm the JCEKS writer needs to serialize the store (e.g. the HMAC used for entry protection). The keystore content is fine; the runtime's crypto registry is missing a piece.","triggerScenarios":"Running on a stripped-down or FIPS-mode JVM whose security.provider list omits SunJCE; JVMs where required algorithms are disabled via jdk.security.legacyAlgorithms or crypto policy; exotic Java builds (embedded JRE).","commonSituations":"Hadoop daemon moved to a hardened/FIPS JVM (e.g. NSS-based) without adding a compatible provider; container images with minimal Java; Java version downgrades between store write and flush.","solutions":["Run the provider on a standard full JDK (OpenJDK/Oracle 8+) where SunJCE supplies JCEKS algorithms","Inspect java.security: ensure security.provider.N=... entries include the provider that wrote the store; add it if missing","For FIPS setups, register BouncyCastle (or equivalent) in java.security and verify JCEKS support before flushing","As a last resort, recreate the store on the target JVM so it serializes with that JVM's available algorithms"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-flight: JCE provider registry must include SunJCE for JCEKS serialization\nstatic boolean jceksWritable() {\n  return java.util.Arrays.stream(java.security.Security.getProviders())\n      .anyMatch(p -> p.getName().equals(\"SunJCE\"));\n}","typeGuard":null,"tryCatchPattern":"try {\n  provider.flush();\n} catch (IOException ex) {\n  if (ex.getCause() instanceof java.security.NoSuchAlgorithmException) {\n    // JVM missing the store integrity algorithm; switch JVM/provider config, do not retry blindly\n  } else { throw ex; }\n}","preventionTips":["Test one full create+flush cycle on any new JVM image before pointing it at production stores","Keep FIPS/hardened JVMs out of the credential-admin path or add a compatible provider first"],"tags":["hadoop","credential-provider","keystore","jce","fips","flush"],"backgroundTag":"jce-algorithm-not-available","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}