t8y2/dbx · error

Hive two-way TLS requires sslTrustStore or a CA certificate

Error message

Hive two-way TLS requires sslTrustStore or a CA certificate

What it means

This error is thrown when Hive two-way TLS is enabled but the driver has no trust anchors: sslTrustStore is unset and config.RootCAs is nil. In mutual TLS the client must verify the server certificate against a CA pool; without a trust store the client cannot authenticate the server, so the driver rejects the config up front.

Source

Thrown at agents/drivers/argo-go/config.go:1113

		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}
	}
	return config, nil
}

func parameter(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return strings.TrimSpace(value)
		}
	}
	return ""
}

func parameterBool(values map[string]string, key string) bool {
	return booleanValue(parameter(values, key))
}

View on GitHub (pinned to c0390bff16)

Solutions

1. Set sslTrustStore (and its password) in the connection config pointing to a keystore containing the server/CA certificates
2. Load the CA certificate pool into the TLS config so config.RootCAs is non-nil
3. If only one-way TLS is needed, drop the twoway parameter so the trust-store requirement no longer applies

Example fix

// before
dsn := "hive://user@hs2.example.com:10000/default?twoway=true&sslKeyStore=/etc/ssl/keystore.p12&sslKeyStorePassword=secret"
// after
dsn := "hive://user@hs2.example.com:10000/default?twoway=true&sslKeyStore=/etc/ssl/keystore.p12&sslKeyStorePassword=secret&sslTrustStore=/etc/ssl/truststore.p12&sslTrustStorePassword=secret"

if strings.EqualFold(values["twoway"], "true") && values["sslTrustStore"] == "" {
	return errors.New("twoway=true requires sslTrustStore (and password)")
}

func hasTrustStore(values map[string]string) bool {
	return values["sslTrustStore"] != ""
}

When it happens

Trigger: Open/Connect with twoway=true while trustStoreLocation is empty and no CA certificate was loaded into config.RootCAs (e.g. sslTrustStore omitted, or its load failed and RootCAs stayed nil).

Common situations: Users add a client keystore for mutual TLS but forget the trust store; custom CA chains inside the corporate network are not provided; the trust store path/password is wrong so RootCAs ends up nil.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Hive two-way TLS requires sslKeyStore or a client certificat
• Hive host is required
• Hive endpoint is empty
• Hive JWT authentication requires jwt or the JWT environment
• Hive delegation token authentication requires delegationToke

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/71aad09aa7b2610a. Report an issue: GitHub.