Hive two-way TLS requires sslTrustStore or a CA certificate

Error message

Hive two-way TLS requires sslTrustStore or a CA certificate

What it means

With two-way TLS enabled, the client must also verify the server's certificate: the driver requires either an sslTrustStore or a CA certificate loaded into config.RootCAs. If both are missing there is no trust anchor for the mTLS handshake, so validation fails before connecting.

Source

Thrown at agents/drivers/hive-go/config.go:1116

		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}
	}
	return config, nil
}

func parameter(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return strings.TrimSpace(value)
		}
	}
	return ""
}

func parameterBool(values map[string]string, key string) bool {
	return booleanValue(parameter(values, key))
}

View on GitHub (pinned to c0390bff16)

Solutions

Set sslCACertificate to a PEM CA file (builds config.RootCAs).
Set sslTrustStore (with trustStorePassword) to supply trust anchors.
Remove twoway=true if one-way TLS is actually intended (system roots would then apply).

Example fix

// before
// twoway=true, sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit
// after
// twoway=true, sslKeyStore=/etc/certs/client.jks, keyStorePassword=changeit, sslCACertificate=/etc/certs/ca.pem

Defensive patterns

Strategy: validation

Validate before calling

if params["twoway"] == "true" || params["twoway"] == "1" {
	if params["ssltruststore"] == "" && params["sslcacertificate"] == "" {
		return fmt.Errorf("two-way TLS needs sslTrustStore or a CA certificate")
	}
}

Prevention

Always ship the cluster CA bundle with the client config
Pair trust store setup with any twoway flag changes in code review
Verify server trust chain with `openssl s_client -connect host:port -CAfile ca.pem`

When it happens

Trigger: Setting twoway=true while sslTrustStore is empty and no sslCACertificate was loaded (config.RootCAs is nil).

Common situations: Configuring client identity (keystore) but forgetting the trust store; self-managed clusters with private CA not shipped to clients; cleaning up 'legacy' TLS params and dropping the CA file reference.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/7922ac642b7c17af. Report an issue: GitHub.