t8y2/dbx · error

read Hive CA certificate: %w

Error message

read Hive CA certificate: %w

What it means

This error wraps the underlying os.ReadFile failure that occurs when the driver tries to load a custom CA certificate bundle for the Hive TLS connection (config.go:1058). It is thrown when the cacert path parameter is set but the file at that path cannot be read. The wrapped error identifies the exact OS-level cause (missing file, permissions, etc.).

Source

Thrown at agents/drivers/hive-go/config.go:1058

	}
	return filepath.Clean(value)
}

func buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {
	enabled := params.SSL || parameterBool(values, "ssl") || strings.EqualFold(parameter(values, "ssl"), "true")
	if !enabled {
		return nil, nil
	}
	config := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}
	if parameterBool(values, "sslinsecureskipverify") || parameterBool(values, "allowselfsigned") {
		config.InsecureSkipVerify = true
	}
	var customRoots *x509.CertPool
	credentialProviderPath := parameter(values, "storepasswordpath")
	if path := strings.TrimSpace(params.CACertPath); path != "" {
		contents, err := os.ReadFile(path)
		if err != nil {
			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify the CA certificate file exists at the configured path (ls / stat the path).
2. Correct the cacert path parameter in the connection configuration.
3. Fix file permissions (chmod/chown) so the process user can read the PEM file.
4. If running in a container, mount the secret/ConfigMap containing the CA cert at the expected path.

Example fix

// before
dsn := "hive://user:pass@host:10000/db?cacert=/etc/ssl/wrong-ca.pem"
// after
dsn := "hive://user:pass@host:10000/db?cacert=/etc/ssl/certs/hive-ca.pem"

if path := params.CACertPath; path != "" {
    if _, err := os.Stat(path); err != nil {
        return fmt.Errorf("Hive CA cert not accessible: %w", err)
    }
}

When it happens

Trigger: The 'cacert'-style driver parameter (params.CACertPath) is non-empty, and os.ReadFile(path) fails: the file does not exist, the path is wrong, or the process lacks read permission.

Common situations: Typo in the CA cert path in the connection string; certificate mounted into a container at a different path; running as a non-root user without read access to the PEM file; secrets volume not mounted at startup.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to parse CA certificate at %s
• load Hive truststore: %w
• load Hive keystore: %w
• read Hive initFile: %w
• Hive host is required

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/cc17adf252d79f9b. Report an issue: GitHub.