prestodb/presto · critical · PrestoException

HIVE_METASTORE_INITIALIZE_SSL_ERROR

HIVE_METASTORE_INITIALIZE_SSL_ERROR

Error message

Hive metastore SSL initialization error: ${e}

What it means

buildSslContext wraps all GeneralSecurityException/IOException from TLS setup (loading key/trust stores, building managers, initializing SSLContext) in a PrestoException with code HIVE_METASTORE_INITIALIZE_SSL_ERROR. It signals that the configured SSL material for the metastore connection is unusable — wrong path, password, format, or algorithm.

Source

Thrown at presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/HiveMetastoreClientFactory.java:161

            }

            // create TrustManagerFactory
            final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(metastoreTrustStore);

            // get X509TrustManager
            final TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
            if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
                throw new RuntimeException("Expected exactly one X509TrustManager, but found:" + Arrays.toString(trustManagers));
            }

            // create SSLContext
            final SSLContext sslContext = SSLContext.getInstance(PROTOCOL);
            sslContext.init(metastoreKeyManagers, trustManagers, null);
            return Optional.of(sslContext);
        }
        catch (GeneralSecurityException | IOException e) {
            throw new PrestoException(HIVE_METASTORE_INITIALIZE_SSL_ERROR, e);
        }
    }

    /**
     * Reads the truststore certificate and returns it
     *
     * @param trustStorePath
     * @param trustStorePassword
     * @throws IOException
     * @throws GeneralSecurityException
     */
    private static KeyStore getTrustStore(File trustStorePath, Optional<String> trustStorePassword)
            throws IOException, GeneralSecurityException
    {
        final KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        try {
            // attempt to read the trust store as a PEM file
            final List<X509Certificate> certificateChain = PemReader.readCertificateChain(trustStorePath);

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check that the keystore/truststore files exist at the configured paths and are readable by the Presto process user.
2. Verify store passwords (ssl.keystore.password / ssl.truststore.password) are correct and current.
3. Run keytool -list against both stores to confirm they open and use the right type (JKS/PKCS12).
4. Inspect the wrapped cause in the Presto log for the exact failure (NoSuchAlgorithmException, UnrecoverableKeyException, FileNotFoundException).
5. Ensure the configured TLS protocol is enabled in the JVM and files use PEM vs JKS consistently.

Example fix

// before
hive.metastore.thrift.ssl.enabled=true
hive.metastore.thrift.ssl.keystore.password=oldpass   # rotated, now wrong
// after
hive.metastore.thrift.ssl.enabled=true
hive.metastore.thrift.ssl.keystore.password=currentpass
# and: chmod 640 /etc/presto/hive-metastore-client.jks (owned by presto user)

// preflight: load both stores exactly as the connector will
char[] pwd = storePassword.toCharArray();
KeyStore ks = KeyStore.getInstance("JKS");
try (InputStream in = Files.newInputStream(Paths.get(keystorePath))) {
    ks.load(in, pwd); // throws if path/password/format wrong
}

try {
    HiveMetastoreClient client = clientFactory.create(metastoreUri, sslConfig...);
} catch (PrestoException e) {
    if (HiveErrorCode.HIVE_METASTORE_INITIALIZE_SSL_ERROR.toErrorCode().equals(e.getErrorCode())) {
        LOG.error("Metastore SSL setup failed; check store paths/passwords: %s", e.getCause());
    } else {
        throw e;
    }
}

When it happens

Trigger: Enabling hive.metastore.thrift.ssl.enabled with a truststore/keystore path that does not exist, a wrong store password, an unsupported store type/algorithm, or unreadable files (permissions) — the underlying load()/init() throws and is wrapped here.

Common situations: Config deployment dropped the .jks file; password rotated but config not updated; file readable only by the hive service user, not the Presto process; TLS protocol disabled by java.security policy; PKCS12 vs JKS mismatch.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• KeyStore certificate is expired: ${e.getMessage()}
• Expected exactly one X509TrustManager, but found: ${trustMan
• KeyStore certificate is not yet valid: ${e.getMessage()}
• Failed to load truststore
• Error setting up SSL:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/a4be1910449ad748. Report an issue: GitHub.