prestodb/presto · error · IllegalArgumentException

'flight-shim.server-ssl-enabled' is enabled but 'flight-shim

Error message

'flight-shim.server-ssl-enabled' is enabled but 'flight-shim.server-ssl-certificate-file' or 'flight-shim.server-ssl-key-file' not set

What it means

FlightShimServer.start() validates SSL configuration when flight-shim.server-ssl-enabled=true. If either the certificate file or the private key file property is missing, it refuses to start a TLS gRPC server because Arrow Flight's builder.useTls() requires both files to exist.

Source

Thrown at presto-flight-shim/src/main/java/com/facebook/presto/flightshim/FlightShimServer.java:80

    public static FlightServer start(Injector injector, FlightServer.Builder builder, Map<String, Map<String, String>> additionalCatalogs)
            throws Exception
    {
        FlightShimPluginManager pluginManager = injector.getInstance(FlightShimPluginManager.class);
        pluginManager.loadPlugins();
        pluginManager.loadCatalogs(additionalCatalogs);

        builder.allocator(injector.getInstance(BufferAllocator.class));
        FlightShimConfig config = injector.getInstance(FlightShimConfig.class);

        if (config.getServerName() == null || config.getServerPort() == null) {
            throw new IllegalArgumentException("Required configuration 'flight-shim.server' and 'flight-shim.server.port' not set");
        }

        if (config.getServerSslEnabled()) {
            builder.location(Location.forGrpcTls(config.getServerName(), config.getServerPort()));
            if (config.getServerSSLCertificateFile() == null || config.getServerSSLKeyFile() == null) {
                throw new IllegalArgumentException("'flight-shim.server-ssl-enabled' is enabled but 'flight-shim.server-ssl-certificate-file' or 'flight-shim.server-ssl-key-file' not set");
            }
            File certChainFile = new File(config.getServerSSLCertificateFile());
            File privateKeyFile = new File(config.getServerSSLKeyFile());
            builder.useTls(certChainFile, privateKeyFile);

            // Check if client cert is provided for mTLS
            if (config.getClientSSLCertificateFile() != null) {
                File clientCertFile = new File(config.getClientSSLCertificateFile());
                builder.useMTlsClientVerification(clientCertFile);
            }
        }
        else {
            builder.location(Location.forGrpcInsecure(config.getServerName(), config.getServerPort()));
        }

        ExecutorService executor = injector.getInstance(Key.get(ExecutorService.class, ForFlightShimServer.class));
        builder.executor(new ContextPropagatingExecutorService(executor));

View on GitHub (pinned to 55bb57d202)

Solutions

1. Set both flight-shim.server-ssl-certificate-file and flight-shim.server-ssl-key-file in the server config to valid PEM file paths.
2. If TLS is not needed yet, set flight-shim.server-ssl-enabled=false.
3. Verify the property names are spelled exactly (ssl-certificate-file vs ssl-cert) so they are actually picked up by the config loader.
4. Confirm the process can read the cert/key files at those paths.

Example fix

// before
flight-shim.server-ssl-enabled=true
// after
flight-shim.server-ssl-enabled=true
flight-shim.server-ssl-certificate-file=/etc/presto/tls/cert.pem
flight-shim.server-ssl-key-file=/etc/presto/tls/key.pem

Properties props = loadProps();
if (Boolean.parseBoolean(props.getProperty("flight-shim.server-ssl-enabled", "false"))) {
    requireNonNull(props.getProperty("flight-shim.server-ssl-certificate-file"), "ssl cert file required");
    requireNonNull(props.getProperty("flight-shim.server-ssl-key-file"), "ssl key file required");
}

When it happens

Trigger: Calling FlightShimServer.start() (typically from main) with flight-shim.server-ssl-enabled=true while flight-shim.server-ssl-certificate-file or flight-shim.server-ssl-key-file is null/unset in the config.

Common situations: Operator enables SSL in the shim's properties file but forgets to add the cert/key paths; deployment templating drops optional properties; migrating from a plaintext setup by only flipping the ssl-enabled flag.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Error setting up SSL:
• Unexpected default trust managers:
• Authentication using username/password requires SSL to be en
• GENERIC_INTERNAL_ERROR
• Failed to load truststore as both PEM and KeyStore format. P

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/adcc15778acccd62. Report an issue: GitHub.