t8y2/dbx · error

read Hive CA certificate: %w

Error message

read Hive CA certificate: %w

What it means

The Hive driver reads a custom CA certificate PEM file when sslCACertPath (params.CACertPath) is set, wrapping any os.ReadFile error with this message. The %w keeps the OS cause (missing file, permissions). It is thrown instead of silently skipping TLS trust configuration because a TLS connection would silently fail or be insecure without the CA.

Source

Thrown at agents/drivers/argo-go/config.go:1055

	}
	return filepath.Clean(value)
}

func buildTLSConfig(params connectParams, values map[string]string, serverName string) (*tls.Config, error) {
	enabled := params.SSL || parameterBool(values, "ssl") || strings.EqualFold(parameter(values, "ssl"), "true")
	if !enabled {
		return nil, nil
	}
	config := &tls.Config{MinVersion: tls.VersionTLS12, ServerName: serverName}
	if parameterBool(values, "sslinsecureskipverify") || parameterBool(values, "allowselfsigned") {
		config.InsecureSkipVerify = true
	}
	var customRoots *x509.CertPool
	credentialProviderPath := parameter(values, "storepasswordpath")
	if path := strings.TrimSpace(params.CACertPath); path != "" {
		contents, err := os.ReadFile(path)
		if err != nil {
			return nil, fmt.Errorf("read Hive CA certificate: %w", err)
		}
		customRoots = x509.NewCertPool()
		if !customRoots.AppendCertsFromPEM(contents) {
			return nil, errors.New("Hive CA certificate contains no certificates")
		}
	}
	trustStoreLocation := parameter(values, "ssltruststore")
	if trustStoreLocation != "" {
		if parameter(values, "truststorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure trustStorePassword explicitly for the native agent")
		}
		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the wrapped cause and verify the file exists and is readable (stat the path before connecting)
2. Use an absolute path for the CA bundle in the connection config
3. Re-deploy/mount the CA certificate file (e.g. configmap/secret volume)
4. Confirm the file contains valid PEM certificates (see the follow-up 'contains no certificates' error if readable but empty)

Example fix

// before
params.CACertPath = "ca.pem" // relative, working dir differs
// after
params.CACertPath = "/etc/hive/certs/ca.pem"

if params.CACertPath != "" {
    pem, err := os.ReadFile(params.CACertPath)
    if err != nil {
        return fmt.Errorf("Hive CA cert unreadable: %w", err)
    }
    if !x509.NewCertPool().AppendCertsFromPEM(pem) {
        return errors.New("CA file has no PEM certificates")
    }
}

if _, err := db.Conn(ctx); err != nil {
    if errors.Is(err, os.ErrNotExist) || errors.Is(err, os.ErrPermission) {
        log.Fatalf("fix Hive CA cert path/permissions: %v", err)
    }
    return err
}

When it happens

Trigger: Opening a Hive connection with the CA-cert path parameter set while os.ReadFile on that path fails — path typo, file deleted, wrong mount, no read permission.

Common situations: Kubernetes secret not mounted; corporate CA bundle path changed after an OS upgrade; using a relative path with a different working directory; mismatch between config written for driver A and driver B hosts.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Hive CA certificate contains no certificates
• Hive client certificate and key must be configured together
• load Hive truststore: %w
• load Hive client certificate: %w
• load Hive keystore: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/41a91524144f1999. Report an issue: GitHub.