t8y2/dbx · error

Hive CA certificate contains no certificates

Error message

Hive CA certificate contains no certificates

What it means

When sslCACertificate (a PEM file path) is configured, the driver reads the file and calls AppendCertsFromPEM to build the TLS root pool. If the PEM content yields no parseable certificates, it refuses to continue with an empty CA pool rather than silently enabling insecure TLS.

Source

Thrown at agents/drivers/hive-go/config.go:1062

func buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {
	enabled := params.SSL || parameterBool(values, "ssl") || strings.EqualFold(parameter(values, "ssl"), "true")
	if !enabled {
		return nil, nil
	}
	config := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}
	if parameterBool(values, "sslinsecureskipverify") || parameterBool(values, "allowselfsigned") {
		config.InsecureSkipVerify = true
	}
	var customRoots *x509.CertPool
	credentialProviderPath := parameter(values, "storepasswordpath")
	if path := strings.TrimSpace(params.CACertPath); path != "" {
		contents, err := os.ReadFile(path)
		if err != nil {
			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}

View on GitHub (pinned to c0390bff16)

Solutions

1. Replace the file with a PEM-encoded certificate (-----BEGIN CERTIFICATE----- blocks).
2. Convert DER/PKCS12 to PEM (e.g. openssl x509 -inform der -in cert.der -out cert.pem).
3. Verify with `openssl x509 -in ca.pem -noout -subject` that the file parses.
4. Re-download the CA bundle from the server/issuer and confirm it is non-empty.

Example fix

// before
params.SSLCACertificate = "/etc/certs/truststore.p12"   // PKCS12, not PEM
// after
params.SSLCACertificate = "/etc/certs/ca-chain.pem"     // PEM-encoded CA

contents, err := os.ReadFile(caPath)
if err != nil { return err }
if !x509.NewCertPool().AppendCertsFromPEM(contents) {
	return fmt.Errorf("%s is not a PEM certificate file", caPath)
}

When it happens

Trigger: Setting sslCACertificate to a file that is not a PEM certificate — an empty file, a DER-encoded cert, a PKCS#12 bundle, or a text/HTML page saved by mistake.

Common situations: Downloading a CA file that returns an HTML error page; exporting from Java keytool in DER/PKCS12 format; copying the wrong file (private key only); empty file mounted into a container.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• PEM truststore contains no certificates
• Hive client certificate and key must be configured together
• Hive two-way TLS requires sslTrustStore or a CA certificate
• PEM truststore contains no certificates
• Hive CA certificate contains no certificates

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2d60ce0c4890329d. Report an issue: GitHub.