t8y2/dbx · error

Hive CA certificate contains no certificates

Error message

Hive CA certificate contains no certificates

What it means

This error is thrown during Hive connection TLS setup when the CA certificate file read from disk is parsed but contains no valid PEM-encoded certificates. The library uses x509.AppendCertsFromPEM to populate a custom root pool, and that method returns false when nothing usable was found, so it refuses to continue with an empty trust store rather than silently falling back to system roots.

Source

Thrown at agents/drivers/argo-go/config.go:1059

func buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {
	enabled := params.SSL || parameterBool(values, "ssl") || strings.EqualFold(parameter(values, "ssl"), "true")
	if !enabled {
		return nil, nil
	}
	config := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}
	if parameterBool(values, "sslinsecureskipverify") || parameterBool(values, "allowselfsigned") {
		config.InsecureSkipVerify = true
	}
	var customRoots *x509.CertPool
	credentialProviderPath := parameter(values, "storepasswordpath")
	if path := strings.TrimSpace(params.CACertPath); path != "" {
		contents, err := os.ReadFile(path)
		if err != nil {
			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the file contains a PEM block starting with '-----BEGIN CERTIFICATE-----' (run: grep -c 'BEGIN CERTIFICATE' <file>; count must be > 0).
2. If the certificate is DER-encoded, convert it: openssl x509 -inform DER -in ca.der -out ca.pem, then point the config at ca.pem.
3. If you accidentally passed a Java truststore (.jks), export its CA to PEM: keytool -exportcert -rfc -keystore truststore.jks -alias ca -file ca.pem, or use the ssltruststore parameter with loadTrustStore instead.
4. If the file is empty (e.g. failed secret mount), fix the source (re-create the Secret/ConfigMap) and remount, then confirm the file size is non-zero.
5. If no custom CA is actually needed, remove the CA-certificate parameter so the library uses system roots.

Example fix

// before
values["sslrootcert"] = "/etc/pki/ca-trust/source/java/cacerts" // JKS file, no PEM certs
// after
values["sslrootcert"] = "/etc/ssl/certs/hive-ca.pem" // PEM-encoded CA bundle

func validatePEMRoots(path string) error {
	b, err := os.ReadFile(path)
	if err != nil { return err }
	pool := x509.NewCertPool()
	if !pool.AppendCertsFromPEM(b) {
		return fmt.Errorf("%s contains no PEM certificates (check format/encoding)", path)
	}
	return nil
}
// run validatePEMRoots(caPath) before building the driver config

func isPEMCertFile(path string) bool {
	b, err := os.ReadFile(path)
	return err == nil && bytes.Contains(b, []byte("-----BEGIN CERTIFICATE-----"))
}

caPool, err := buildCAPool(path)
if err != nil {
	if strings.Contains(err.Error(), "contains no certificates") {
		// surface file format guidance / fall back to system roots if policy allows
	}
	return err
}

When it happens

Trigger: Calling the Hive driver configuration (config.go, TLS setup path) with the sslrootcert / CA-certificate parameter set to a file path whose contents are not a PEM certificate (wrong file, empty file, DER-encoded cert, or a Java .jks truststore passed by mistake).

Common situations: Pointing sslrootcert at a key file or CSR instead of the cert; exporting a certificate in DER format from Windows; passing a Java keystore file where a PEM CA bundle is expected after migrating from the JDBC (Java) Hive driver to the native agent; an empty or truncated file produced by a failed secret mount or ConfigMap projection in Kubernetes.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Hive client certificate and key must be configured together
• read Hive CA certificate: %w
• load Hive truststore: %w
• load Hive client certificate: %w
• load Hive keystore: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/6fee03958b2d6909. Report an issue: GitHub.