prestodb/presto · error · ArrowException

ARROW_FLIGHT_INVALID_CERT_ERROR

ARROW_FLIGHT_INVALID_CERT_ERROR

Error message

Error creating flight client, invalid certificate file: 

What it means

In the same createFlightClient catch block, if the exception chain contains a java.security.cert.CertificateException, the handler throws ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR) with 'Error creating flight client, invalid certificate file: <msg>'. The trusted CA file or client certificate configured for the FlightClient could not be parsed or loaded, so the client cannot be built.

Solutions

1. Open the cert file and confirm valid PEM content ('-----BEGIN CERTIFICATE-----') with no stray text.
2. Check you configured the certificate path, not the key path, in catalog properties.
3. Re-export the CA/client certificate; replace if expired or corrupted.
4. Verify the CA actually signed the Flight server certificate (openssl verify).
5. Confirm full-chain concatenation order (server/intermediate/root) if a bundle is used.

Example fix

# before: cert path misconfigured
arrow.flight.trusted-certificate=/etc/tls/client.key
# after
arrow.flight.trusted-certificate=/etc/tls/ca-cert.pem

// Validate the certificate parses before creating the client
java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509");
try (java.io.InputStream in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(certPath))) {
    java.util.Collection<? extends java.security.cert.Certificate> certs = cf.generateCertificates(in);
    if (certs.isEmpty()) throw new IllegalStateException("No certificates in " + certPath);
}

try {
    FlightClient client = handler.createFlightClient();
} catch (ArrowException e) {
    if (e.getErrorCode().getCode() == ARROW_FLIGHT_INVALID_CERT_ERROR.getCode()) {
        // re-export/replace CA or client cert, then rebuild client
    }
    throw e;
}

When it happens

Trigger: Calling createFlightClient when the configured truststore/CA PEM or client cert file fails CertificateFactory parsing — bad PEM formatting, wrong file, expired/unparseable certificate, or empty file.

Common situations: Certificate chain file concatenated incorrectly (extra text/whitespace breaking PEM parsing); pointed at the key file instead of the cert; certificate expired or self-signed CA not matching server cert; cert re-issued in a format the JDK rejects.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ARROW_FLIGHT_INVALID_KEY_ERROR
• ARROW_FLIGHT_CLIENT_ERROR
• ARROW_FLIGHT_INFO_ERROR
• ARROW_FLIGHT_METADATA_ERROR
• ARROW_FLIGHT_METADATA_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/6be6ae381af4905c. Report an issue: GitHub.

Appendix: source

Thrown at presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java:96

            flightClientBuilder.verifyServer(config.getVerifyServer());
            if (config.getFlightServerSSLCertificate() != null) {
                trustedCertificate = Optional.of(newInputStream(Paths.get(config.getFlightServerSSLCertificate())));
                flightClientBuilder.trustedCertificates(trustedCertificate.get()).useTls();
            }
            if (config.getFlightClientSSLCertificate() != null && config.getFlightClientSSLKey() != null) {
                clientCertificate = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLCertificate())));
                clientKey = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLKey())));
                flightClientBuilder.clientCertificate(clientCertificate.get(), clientKey.get()).useTls();
            }

            return flightClientBuilder.build();
        }
        catch (Exception e) {
            if (e.getCause() instanceof InvalidKeyException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_KEY_ERROR, "Error creating flight client, invalid key file: " + e.getMessage(), e);
            }
            else if (e.getCause() instanceof CertificateException) {
                throw new ArrowException(ARROW_FLIGHT_INVALID_CERT_ERROR, "Error creating flight client, invalid certificate file: " + e.getMessage(), e);
            }
            else {
                throw new ArrowException(ARROW_FLIGHT_CLIENT_ERROR, "Error creating flight client: " + e.getMessage(), e);
            }
        }
        finally {
            if (trustedCertificate.isPresent()) {
                try {
                    trustedCertificate.get().close();
                }
                catch (IOException e) {
                    logger.error("Error closing input stream for server certificate", e);
                }
            }
            if (clientCertificate.isPresent()) {
                try {
                    clientCertificate.get().close();
                }

View on GitHub (pinned to 55bb57d202)