prestodb/presto · error · ArrowException

ARROW_FLIGHT_INVALID_CERT_ERROR

ARROW_FLIGHT_INVALID_CERT_ERROR

Error message

Error creating flight client, invalid certificate file:

What it means

In the same createFlightClient catch block, if the exception chain contains a java.security.cert.CertificateException, the handler throws ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR) with 'Error creating flight client, invalid certificate file: <msg>'. The trusted CA file or client certificate configured for the FlightClient could not be parsed or loaded, so the client cannot be built.

Source

Thrown at presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java:96

            flightClientBuilder.verifyServer(config.getVerifyServer());
            if (config.getFlightServerSSLCertificate() != null) {
                trustedCertificate = Optional.of(newInputStream(Paths.get(config.getFlightServerSSLCertificate())));
                flightClientBuilder.trustedCertificates(trustedCertificate.get()).useTls();
            }
            if (config.getFlightClientSSLCertificate() != null && config.getFlightClientSSLKey() != null) {
                clientCertificate = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLCertificate())));
                clientKey = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLKey())));
                flightClientBuilder.clientCertificate(clientCertificate.get(), clientKey.get()).useTls();
            }

            return flightClientBuilder.build();
        }
        catch (Exception e) {
            if (e.getCause() instanceof InvalidKeyException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_KEY_ERROR, "Error creating flight client, invalid key file: " + e.getMessage(), e);
            }
            else if (e.getCause() instanceof CertificateException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR, "Error creating flight client, invalid certificate file: " + e.getMessage(), e);
            }
            else {
                throw new ArrowException(ARROW_FLIGHT_CLIENT_ERROR, "Error creating flight client: " + e.getMessage(), e);
            }
        }
        finally {
            if (trustedCertificate.isPresent()) {
                try {
                    trustedCertificate.get().close();
                }
                catch (IOException e) {
                    logger.error("Error closing input stream for server certificate", e);
                }
            }
            if (clientCertificate.isPresent()) {
                try {
                    clientCertificate.get().close();
                }

View on GitHub (pinned to 55bb57d202)

Solutions

Open the cert file and confirm valid PEM content ('-----BEGIN CERTIFICATE-----') with no stray text.
Check you configured the certificate path, not the key path, in catalog properties.
Re-export the CA/client certificate; replace if expired or corrupted.
Verify the CA actually signed the Flight server certificate (openssl verify).
Confirm full-chain concatenation order (server/intermediate/root) if a bundle is used.

Example fix

# before: cert path misconfigured
arrow.flight.trusted-certificate=/etc/tls/client.key
# after
arrow.flight.trusted-certificate=/etc/tls/ca-cert.pem

Defensive patterns

Strategy: validation

Validate before calling

// Validate the certificate parses before creating the client
java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509");
try (java.io.InputStream in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(certPath))) {
    java.util.Collection<? extends java.security.cert.Certificate> certs = cf.generateCertificates(in);
    if (certs.isEmpty()) throw new IllegalStateException("No certificates in " + certPath);
}

Try / catch

try {
    FlightClient client = handler.createFlightClient();
} catch (ArrowException e) {
    if (e.getErrorCode().getCode() == ARROW_FLIGHT_INVALID_CERT_ERROR.getCode()) {
        // re-export/replace CA or client cert, then rebuild client
    }
    throw e;
}

Prevention

Monitor certificate expiry and rotate before expiration.
Validate PEM bundles contain only certificates (no keys, no extra text).
Verify the CA against the server cert with `openssl verify -CAfile ca.pem server.pem`.
Mount cert files read-only and confirm paths after each config change.

When it happens

Trigger: Calling createFlightClient when the configured truststore/CA PEM or client cert file fails CertificateFactory parsing — bad PEM formatting, wrong file, expired/unparseable certificate, or empty file.

Common situations: Certificate chain file concatenated incorrectly (extra text/whitespace breaking PEM parsing); pointed at the key file instead of the cert; certificate expired or self-signed CA not matching server cert; cert re-issued in a format the JDK rejects.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/6be6ae381af4905c. Report an issue: GitHub.