prestodb/presto · critical · SQLException

Authentication using username/password requires SSL to be en

Error message

Authentication using username/password requires SSL to be enabled

What it means

setupClient() enforces that when a non-empty password is configured for basic authentication, the connection must be secure (HTTPS). It throws SQLException('Authentication using username/password requires SSL to be enabled') because sending credentials over plain HTTP would expose them. The password comes from the 'password' property; '***empty***' is treated as empty for compatibility with Tempto tests.

Source

Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:263

        return FOLLOW_REDIRECTS.getValue(properties).orElse(true);
    }

    public void setupClient(OkHttpClient.Builder builder)
            throws SQLException
    {
        try {
            setupCookieJar(builder);
            setupSocksProxy(builder, SOCKS_PROXY.getValue(properties));
            setupHttpProxy(builder, HTTP_PROXY.getValue(properties));

            // add user specified protocols to okhttp3 client if specified
            getProtocols().ifPresent(builder::protocols);

            // TODO: fix Tempto to allow empty passwords
            String password = PASSWORD.getValue(properties).orElse("");
            if (!password.isEmpty() && !password.equals("***empty***")) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using username/password requires SSL to be enabled");
                }
                builder.addInterceptor(basicAuth(getUser(), password));
            }

            if (useSecureConnection) {
                setupSsl(
                        builder,
                        SSL_KEY_STORE_PATH.getValue(properties),
                        SSL_KEY_STORE_PASSWORD.getValue(properties),
                        SSL_KEY_STORE_TYPE.getValue(properties),
                        SSL_TRUST_STORE_PATH.getValue(properties),
                        SSL_TRUST_STORE_PASSWORD.getValue(properties),
                        SSL_TRUST_STORE_TYPE.getValue(properties));
            }

            if (KERBEROS_REMOTE_SERVICE_NAME.getValue(properties).isPresent()) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using Kerberos requires SSL to be enabled");

View on GitHub (pinned to 55bb57d202)

Solutions

1. Change the JDBC URL scheme to https (jdbc:presto://host:8443) so useSecureConnection is true
2. Add proper SSL setup: SSLTrustStorePath/SSLTrustStorePassword/SSLTrustStoreType properties or keystore config
3. For test environments without auth, remove the password property instead of sending credentials over http
4. If TLS is terminated elsewhere, use an https endpoint that still encrypts the credential-bearing request

Example fix

// before
String url = "jdbc:presto://coordinator:8080/catalog/schema?user=alice&password=secret";
// after
String url = "jdbc:presto://coordinator:8443/catalog/schema?user=alice&password=secret&SSLTrustStorePath=/etc/truststore.jks&SSLTrustStorePassword=changeit";

String url = jdbcUrl;
String password = props.getProperty("password");
if (password != null && !password.isEmpty() && !password.equals("***empty***") && !url.startsWith("jdbc:presto://https") && !url.contains(":8443") && !props.containsKey("SSLTrustStorePath") && url.contains("http://")) {
    throw new IllegalArgumentException("password set but connection is not SSL; use https URL");
}

try { return DriverManager.getConnection(url, props); } catch (SQLException e) { if (e.getMessage().contains("username/password requires SSL")) { throw new ConfigurationException("Enable https in JDBC URL or remove the password property", e); } throw e; }

When it happens

Trigger: Connecting with jdbc:presto://... (no https) while supplying both user and password properties, e.g. url 'jdbc:presto://host:8080?user=bob&password=secret'.

Common situations: Migrating from unauthenticated clusters to LDAP/password-authenticated coordinators, forgetting to switch URL scheme to https, disabling SSL for local testing while still setting a password.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication using Kerberos requires SSL to be enabled
• Error setting up SSL:
• Loaded truststore is empty - no certificates found in:
• UNEXPECTED_ACCUMULO_ERROR
• JDBC_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/c07c065548ee310c. Report an issue: GitHub.