{"record":{"id":"fbdaeffd0dfdec10","repo":"apache/hadoop","slug":"no-configuration-found-for-the-cipher-suite-pre","errorCode":null,"errorMessage":"No configuration found for the cipher suite {} prefixed with hadoop.security.crypto.codec.classes. Please see the example configuration hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE at core-default.xml for details.","messagePattern":"No configuration found for the cipher suite (.+?) prefixed with hadoop\\.security\\.crypto\\.codec\\.classes\\. Please see the example configuration hadoop\\.security\\.crypto\\.codec\\.classes\\.EXAMPLECIPHERSUITE at core-default\\.xml for details\\.","errorType":"exception","errorClass":"UnknownCipherSuiteException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java","lineNumber":112,"sourceCode":"   * Obtain a CryptoCodec based on the CipherSuite set in a FileEncryptionInfo\n   * and the available CryptoCodecs configured in the Configuration.\n   *\n   * @param conf   Configuration\n   * @param feInfo FileEncryptionInfo\n   * @return CryptoCodec\n   * @throws IOException if no suitable CryptoCodec for the CipherSuite is\n   *                     available.\n   */\n  public static CryptoCodec getCryptoCodec(Configuration conf,\n      FileEncryptionInfo feInfo) throws IOException {\n    final CipherSuite suite = feInfo.getCipherSuite();\n    if (suite.equals(CipherSuite.UNKNOWN)) {\n      throw new IOException(\"NameNode specified unknown CipherSuite with ID \"\n          + suite.getUnknownValue() + \", cannot instantiate CryptoCodec.\");\n    }\n    final CryptoCodec codec = CryptoCodec.getInstance(conf, suite);\n    if (codec == null) {\n      throw new UnknownCipherSuiteException(\n          \"No configuration found for the cipher suite \"\n              + suite.getConfigSuffix() + \" prefixed with \"\n              + HADOOP_SECURITY_CRYPTO_CODEC_CLASSES_KEY_PREFIX\n              + \". Please see the example configuration \"\n              + \"hadoop.security.crypto.codec.classes.EXAMPLECIPHERSUITE \"\n              + \"at core-default.xml for details.\");\n    }\n    return codec;\n  }\n\n  /**\n   * The key provider uri is searched in the following order.\n   * 1. If there is a mapping in Credential's secrets map for namenode uri.\n   * 2. From namenode getServerDefaults call.\n   * 3. Finally fallback to local conf.\n   * @return keyProviderUri if found from either of above 3 cases,\n   * null otherwise\n   * @throws IOException","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/HdfsKMSUtil.java#L94-L130","documentation":"After resolving a known CipherSuite, HdfsKMSUtil asks CryptoCodec.getInstance(conf, suite) for a codec implementation; if it returns null, no class is configured for the hadoop.security.crypto.codec.classes.<suffix> key matching the suite, and an UnknownCipherSuiteException with this message is thrown. Stock core-default.xml ships JceAesCtrCryptoCodec/OpensslAesCtrCryptoCodec for the default suites, so the usual root cause is a stripped or absent core-default.xml on the client classpath.","triggerScenarios":"Reading an encryption-zone file with a Configuration that lacks the codec mapping: custom minimal core-site.xml without core-default.xml, an embedded/app-assembly Hadoop config that dropped defaults, or a suite whose config suffix has no hadoop.security.crypto.codec.classes.* entry.","commonSituations":"Applications constructing Configuration manually (new Configuration(false) plus partial resources); Oozie/Spark assemblies pruning default XMLs; disabling/renaming crypto codec properties for a security review and forgetting the encrypted-path use case.","solutions":["Ensure core-default.xml is on the classpath (addResource or keep defaults loaded) so the built-in codec entries are visible","Explicitly set the codec property, e.g. hadoop.security.crypto.codec.classes.aes.ctr.nopadding = org.apache.hadoop.crypto.JceAesCtrCryptoCodec,org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec","Verify the JCE/OpenSSL providers actually load (JceAesCtrCryptoCodec requires JDK JCE; the OpenSSL variant requires libcrypto) — misconfigured SSL natives can make getInstance return null"],"exampleFix":"<!-- before: no codec mapping visible -->\n<configuration><!-- nothing for crypto codecs --></configuration>\n\n<!-- after -->\n<property>\n  <name>hadoop.security.crypto.codec.classes.aes.ctr.nopadding</name>\n  <value>org.apache.hadoop.crypto.JceAesCtrCryptoCodec,org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec</value>\n</property>","handlingStrategy":"validation","validationCode":"// Fail fast if the codec mapping for the default suite is missing:\nString key = \"hadoop.security.crypto.codec.classes\"\n    + CipherSuite.AES_CTR_NOPADDING.getConfigSuffix();\nif (conf.get(key) == null && !conf.getBoolean(\"fs.hdfs.impl.disable.cache\", false)) {\n  conf.set(key, \"org.apache.hadoop.crypto.JceAesCtrCryptoCodec,\"\n      + \"org.apache.hadoop.crypto.OpensslAesCtrCryptoCodec\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  return HdfsKMSUtil.getCryptoCodec(conf, feInfo);\n} catch (UnknownCipherSuiteException e) {\n  // add core-default.xml / explicit codec classes, then retry once\n  conf.addResource(\"core-default.xml\");\n  return HdfsKMSUtil.getCryptoCodec(conf, feInfo);\n}","preventionTips":["Never build Configuration(false) without adding core-default.xml for clients that read encrypted data","Smoke-test reading one encryption-zone file in every deployment environment","Keep the hadoop.security.crypto.codec.classes.* defaults intact unless you replace them with tested alternatives"],"tags":["hdfs","encryption","cipher-suite","configuration","kms"],"backgroundTag":"unsupported-cipher-suite","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}