{"record":{"id":"eb9aa8c1ba4a47b4","repo":"apache/hadoop","slug":"can-t-recover-key-key-from-path","errorCode":null,"errorMessage":"Can't recover key ${key} from ${path}","messagePattern":"Can't recover key (.+?) from (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":344,"sourceCode":"\n  @Override\n  public KeyVersion getKeyVersion(String versionName) throws IOException {\n    readLock.lock();\n    try {\n      SecretKeySpec key = null;\n      try {\n        if (!keyStore.containsAlias(versionName)) {\n          return null;\n        }\n        key = (SecretKeySpec) keyStore.getKey(versionName, password);\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get key \" + versionName + \" from \" +\n                              path, e);\n      } catch (NoSuchAlgorithmException e) {\n        throw new IOException(\"Can't get algorithm for key \" + key + \" from \" +\n                              path, e);\n      } catch (UnrecoverableKeyException e) {\n        throw new IOException(\"Can't recover key \" + key + \" from \" + path, e);\n      }\n      return new KeyVersion(getBaseName(versionName), versionName, key.getEncoded());\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public List<String> getKeys() throws IOException {\n    readLock.lock();\n    try {\n      ArrayList<String> list = new ArrayList<String>();\n      String alias = null;\n      try {\n        Enumeration<String> e = keyStore.aliases();\n        while (e.hasMoreElements()) {\n           alias = e.nextElement();\n           // only include the metadata key names in the list of names","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L326-L362","documentation":"In getKeyVersion(), the keystore threw UnrecoverableKeyException: the supplied keystore password cannot decrypt the requested key entry. Almost always a password mismatch between the provider configuration and the keystore (or per-entry key password).","triggerScenarios":"KeyProvider.getKeyVersion() with KEYSTORE_PASSWORD_FILE_KEY pointing at a wrong/stale password file, or a keystore whose store password was rotated without updating the KMS configuration. The key entry exists (alias found) but getKey(alias, password) fails to decrypt it.","commonSituations":"Keystore password rotated by an admin but KMS config not updated; password file has trailing whitespace/newline issues; different environments (prod vs staging) sharing a keystore with different passwords","solutions":["Verify the password: keytool -list -keystore <path> -storetype jceks with the same password file content — if it fails, fix the password file referenced by KEYSTORE_PASSWORD_FILE_KEY","Strip trailing newlines/whitespace from the password file content expectations — match exactly how the file is read","If the store password was intentionally rotated, re-protect or recreate entries and restart KMS","Check the nested cause to confirm 'password incorrect' style errors rather than corruption"],"exampleFix":"# before: KMS log: Can't recover key mykey@0 from /keys/ks.jks\n\n# after: confirm what password KMS reads\ngrep -r KEYSTORE_PASSWORD_FILE_KEY /etc/hadoop/\nprintf '%s' \"$(cat /etc/security/ks.pwd)\" | keytool -list \\\n  -keystore /keys/ks.jks -storetype jceks -storepass:file /etc/security/ks.pwd\n# mismatch -> update password file, restart KMS","handlingStrategy":"validation","validationCode":"// Prove the password decrypts before serving traffic\nKeyStore ks = KeyStore.getInstance(\"jceks\");\nks.load(Files.newInputStream(ksPath), passwordFromFile(conf));\nks.getKey(someAlias, passwordFromFile(conf)); // throws early if wrong","typeGuard":null,"tryCatchPattern":"try {\n  KeyVersion kv = provider.getKeyVersion(versionName);\n} catch (IOException e) {\n  if (e.getCause() instanceof UnrecoverableKeyException) {\n    // password mismatch: fix KEYSTORE_PASSWORD_FILE_KEY content, restart KMS\n  }\n}","preventionTips":["Keep exactly one source of truth for the keystore password and distribute it atomically","Validate password files after every rotation with a scripted keytool check","Never let different KMS hosts carry different password files for the same keystore"],"tags":["keystore","kms","crypto","password","key-recovery"],"backgroundTag":"keystore-wrong-password","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}