What causes "load Hive keystore: %w" in t8y2/dbx?

Check the wrapped cause; verify the keystore path exists and is readable

load Hive keystore

Error message

load Hive keystore: %w

What it means

When the sslKeyStore parameter is set, the driver calls loadClientKeyStore to extract a client certificate and wraps any failure with this message. The %w preserves the underlying cause — bad path, wrong keystorepassword, unsupported keystoretype. It is thrown because the driver cannot add the client certificate to the TLS config without successfully loading the store.

Solutions

Check the wrapped cause; verify the keystore path exists and is readable
Confirm keystorepassword is current and keystoretype matches the file format
Regenerate the keystore in a supported format (PKCS12 recommended)
Alternatively provide clientCertPath/clientKeyPath PEM pair instead of a keystore

Example fix

// before
values["keystoretype"] = "JKS"
// after
values["keystoretype"] = "PKCS12" // matches the actual store format

Defensive patterns

Strategy: validation

Validate before calling

if loc := values["sslkeystore"]; loc != "" {
    if _, err := os.Stat(loc); err != nil {
        return fmt.Errorf("keystore missing: %w", err)
    }
    if values["keystorepassword"] == "" && credentialProvider == "" {
        return errors.New("keystorepassword or credential provider required")
    }
}

Try / catch

if err := db.PingContext(ctx); err != nil {
    if strings.HasPrefix(err.Error(), "load Hive keystore:") {
        // refresh password / fix type, then retry
    }
    return err
}

Prevention

Keep keystore passwords in a credential provider or secret manager
Use PKCS12 keystores with matching keystoretype setting
Load-test the keystore with the client library before deploy
Prefer clientCertPath/clientKeyPath PEM pairs when possible

When it happens

Trigger: Opening a Hive connection with sslKeyStore configured and loadClientKeyStore fails: unreadable store file, wrong keystorepassword, unexpected keystoretype, or corrupt store.

Common situations: Keystore password changed by security rotation; PKCS12 vs JKS type mismatch; keystore path typo; store generated with a key algorithm the Go loader can't parse (e.g. legacy formats).

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/4e60ce9a4a0d41a5. Report an issue: GitHub.

Appendix: source

Thrown at agents/drivers/argo-go/config.go:1104

		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}
	}
	return config, nil
}

func parameter(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return strings.TrimSpace(value)

View on GitHub (pinned to c0390bff16)