prestodb/presto · critical · SQLException

Authentication using Kerberos requires SSL to be enabled

Error message

Authentication using Kerberos requires SSL to be enabled

What it means

setupClient() throws SQLException('Authentication using Kerberos requires SSL to be enabled') when Kerberos authentication is configured (KERBEROS_REMOTE_SERVICE_NAME property present) but the connection is not secure. Kerberos credentials/tokens must not transit plain HTTP, so the driver refuses the insecure configuration.

Source

Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:281

                    throw new SQLException("Authentication using username/password requires SSL to be enabled");
                }
                builder.addInterceptor(basicAuth(getUser(), password));
            }

            if (useSecureConnection) {
                setupSsl(
                        builder,
                        SSL_KEY_STORE_PATH.getValue(properties),
                        SSL_KEY_STORE_PASSWORD.getValue(properties),
                        SSL_KEY_STORE_TYPE.getValue(properties),
                        SSL_TRUST_STORE_PATH.getValue(properties),
                        SSL_TRUST_STORE_PASSWORD.getValue(properties),
                        SSL_TRUST_STORE_TYPE.getValue(properties));
            }

            if (KERBEROS_REMOTE_SERVICE_NAME.getValue(properties).isPresent()) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using Kerberos requires SSL to be enabled");
                }
                setupKerberos(
                        builder,
                        KERBEROS_REMOTE_SERVICE_NAME.getRequiredValue(properties),
                        KERBEROS_USE_CANONICAL_HOSTNAME.getRequiredValue(properties),
                        KERBEROS_PRINCIPAL.getValue(properties),
                        KERBEROS_CONFIG_PATH.getValue(properties),
                        KERBEROS_KEYTAB_PATH.getValue(properties),
                        Optional.ofNullable(KERBEROS_CREDENTIAL_CACHE_PATH.getValue(properties)
                                .orElseGet(() -> defaultCredentialCachePath().map(File::new).orElse(null))));
            }

            Map<String, String> extraCredentials = EXTRA_CREDENTIALS.getValue(properties).orElse(ImmutableMap.of());
            Optional.ofNullable(extraCredentials.get(GCS_CREDENTIALS_PATH_KEY))
                    .ifPresent(credentialPath -> OkHttpUtil.setupGCSOauth(builder, credentialPath, Optional.ofNullable(extraCredentials.get(GCS_OAUTH_SCOPES_KEY))));

            if (ACCESS_TOKEN.getValue(properties).isPresent()) {
                if (!useSecureConnection) {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Use an https URL (jdbc:presto://host:8443) so useSecureConnection is true
2. Configure SSL trust settings (SSLTrustStorePath/SSLTrustStorePassword/SSLTrustStoreType) to validate the coordinator certificate
3. Remove KERBEROS_REMOTE_SERVICE_NAME if Kerberos was not intended for that connection
4. Ensure the coordinator serves HTTPS with the Kerberos/SPNEGO service configured

Example fix

// before
Properties p = new Properties();
p.setProperty("user", "alice");
p.setProperty("KerberosRemoteServiceName", "HTTP");
Connection c = DriverManager.getConnection("jdbc:presto://host:8080/...", p);
// after
p.setProperty("SSLTrustStorePath", "/etc/presto/truststore.jks");
p.setProperty("SSLTrustStorePassword", "changeit");
Connection c = DriverManager.getConnection("jdbc:presto://host:8443/...", p);

if (props.getProperty("KerberosRemoteServiceName") != null && !jdbcUrl.replaceFirst("jdbc:presto://", "").split("/")[0].matches(".*:(443|8443)")) {
    throw new IllegalArgumentException("Kerberos configured but URL is not https");
}

try { return DriverManager.getConnection(url, props); } catch (SQLException e) { if (e.getMessage().contains("Kerberos requires SSL")) { throw new ConfigurationException("Switch to https and configure SSLTrustStore properties", e); } throw e; }

When it happens

Trigger: Setting KERBEROS_REMOTE_SERVICE_NAME (plus principal/keytab config) while connecting to a plain http:// jdbc:presto:// URL.

Common situations: Enabling Kerberos after moving from an unsecured test cluster but leaving port 8080/http, ops templates that configure Kerberos properties globally while some URLs lack https, TLS termination misconfiguration.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication using username/password requires SSL to be en
• Error setting up SSL:
• Kerberos error for [%s]: %s
• Loaded truststore is empty - no certificates found in:
• Failed to verify truststore contents

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/ac70f94aa2e92b0e. Report an issue: GitHub.