t8y2/dbx · error

load Hive keystore: %w

Error message

load Hive keystore: %w

What it means

This error wraps failures from loadClientKeyStore when loading a client certificate from a keystore for Hive TLS (config.go:1107). It fires when the 'sslkeystore' location parameter is set but the keystore cannot be opened, decrypted with keystorepassword, or parsed with keystoretype. The wrapped error carries the loader's specific cause.

Source

Thrown at agents/drivers/hive-go/config.go:1107

		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}
	if parameterBool(values, "twoway") {
		if keyStoreLocation == "" && len(config.Certificates) == 0 {
			return nil, errors.New("Hive two-way TLS requires sslKeyStore or a client certificate")
		}
		if trustStoreLocation == "" && config.RootCAs == nil {
			return nil, errors.New("Hive two-way TLS requires sslTrustStore or a CA certificate")
		}
	}
	return config, nil
}

func parameter(values map[string]string, key string) string {
	for candidate, value := range values {
		if strings.EqualFold(strings.TrimSpace(candidate), key) {
			return strings.TrimSpace(value)

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify keystorepassword is correct for the keystore file.
2. Set keystoretype to match the actual format (JKS vs PKCS12).
3. Confirm the keystore file exists and is readable at the sslkeystore path.
4. Convert the keystore (e.g. keytool -importkeystore to PKCS12) if the format is unsupported.

Example fix

// before
dsn += "&sslkeystore=/etc/hive/client.p12&keystoretype=JKS"
// after
dsn += "&sslkeystore=/etc/hive/client.p12&keystorepassword=secret&keystoretype=PKCS12"

if loc := params["sslkeystore"]; loc != "" {
    if _, err := os.Stat(loc); err != nil {
        return fmt.Errorf("keystore not accessible: %w", err)
    }
    if params["keystorepassword"] == "" {
        return errors.New("keystorepassword required with sslkeystore")
    }
}

When it happens

Trigger: The 'sslkeystore' parameter is non-empty and loadClientKeyStore(location, keystorepassword, keystoretype) returns an error: wrong password, wrong or missing keystoretype, unreadable/corrupt file.

Common situations: Porting a Java Hive JDBC config (sslkeystore/keystorepassword) to the Go driver with an incorrect password; JKS file used while keystoretype says PKCS12; keystore not copied into the deployment; key alias password differs from store password.

Related errors

• failed to parse CA certificate at %s
• read Hive CA certificate: %w
• load Hive truststore: %w
• Hive host is required
• Hive endpoint is empty

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e2ddeae6e62ed949. Report an issue: GitHub.